LLVMFuzzerTestOneInput: 114| 6.53k|extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { 115| 6.53k| if (size < 8) return 0; ------------------ | Branch (115:9): [True: 4, False: 6.52k] ------------------ 116| | 117| | /* Test 1: Standard PNG reading with transformations */ 118| 6.52k| test_png_transformations(data, size); 119| | 120| 6.52k| return 0; 121| 6.53k|} libpng_transformations_fuzzer.cc:_ZL24test_png_transformationsPKhm: 25| 6.52k|static void test_png_transformations(const uint8_t *data, size_t size) { 26| 6.52k| png_structp png_ptr = png_create_read_struct(PNG_LIBPNG_VER_STRING, NULL, NULL, NULL); ------------------ | | 244| 6.52k|#define png_create_read_struct OSS_FUZZ_png_create_read_struct ------------------ png_structp png_ptr = png_create_read_struct(PNG_LIBPNG_VER_STRING, NULL, NULL, NULL); ------------------ | | 277| 6.52k|#define PNG_LIBPNG_VER_STRING "1.6.59.git" ------------------ 27| 6.52k| if (!png_ptr) return; ------------------ | Branch (27:9): [True: 0, False: 6.52k] ------------------ 28| | 29| 6.52k| png_infop info_ptr = png_create_info_struct(png_ptr); ------------------ | | 243| 6.52k|#define png_create_info_struct OSS_FUZZ_png_create_info_struct ------------------ 30| 6.52k| if (!info_ptr) { ------------------ | Branch (30:9): [True: 0, False: 6.52k] ------------------ 31| 0| png_destroy_read_struct(&png_ptr, NULL, NULL); ------------------ | | 250| 0|#define png_destroy_read_struct OSS_FUZZ_png_destroy_read_struct ------------------ 32| 0| return; 33| 0| } 34| | 35| | /* Declare heap pointers before setjmp so they can be freed on longjmp. 36| | Must be volatile per C standard ยง7.13.2.1: non-volatile locals modified 37| | between setjmp and longjmp have indeterminate values after longjmp. */ 38| 6.52k| volatile png_bytep row = NULL; 39| 6.52k| volatile png_colorp palette = NULL; 40| | 41| 6.52k| if (setjmp(png_jmpbuf(png_ptr))) { ------------------ | Branch (41:9): [True: 6.46k, False: 68] ------------------ 42| 6.46k| free((void*)row); 43| 6.46k| free((void*)palette); 44| 6.46k| png_destroy_read_struct(&png_ptr, &info_ptr, NULL); ------------------ | | 250| 6.46k|#define png_destroy_read_struct OSS_FUZZ_png_destroy_read_struct ------------------ 45| 6.46k| return; 46| 6.46k| } 47| | 48| 68| struct png_mem_buffer buffer = {data, size, 0}; 49| 68| png_set_read_fn(png_ptr, &buffer, png_read_from_buffer); ------------------ | | 417| 68|#define png_set_read_fn OSS_FUZZ_png_set_read_fn ------------------ 50| | 51| 68| png_read_info(png_ptr, info_ptr); ------------------ | | 357| 68|#define png_read_info OSS_FUZZ_png_read_info ------------------ 52| | 53| 68| int width = png_get_image_width(png_ptr, info_ptr); ------------------ | | 287| 68|#define png_get_image_width OSS_FUZZ_png_get_image_width ------------------ 54| 68| int height = png_get_image_height(png_ptr, info_ptr); ------------------ | | 286| 68|#define png_get_image_height OSS_FUZZ_png_get_image_height ------------------ 55| 68| int color_type = png_get_color_type(png_ptr, info_ptr); ------------------ | | 270| 68|#define png_get_color_type OSS_FUZZ_png_get_color_type ------------------ 56| 68| int bit_depth = png_get_bit_depth(png_ptr, info_ptr); ------------------ | | 259| 68|#define png_get_bit_depth OSS_FUZZ_png_get_bit_depth ------------------ 57| | 58| | /* Sanity check dimensions */ 59| 1.26k| if (width <= 0 || height <= 0 || width > 2048 || height > 2048) { ------------------ | Branch (59:9): [True: 18.4E, False: 1.26k] | Branch (59:23): [True: 0, False: 1.26k] | Branch (59:38): [True: 7, False: 1.25k] | Branch (59:54): [True: 8, False: 1.25k] ------------------ 60| 15| png_destroy_read_struct(&png_ptr, &info_ptr, NULL); ------------------ | | 250| 15|#define png_destroy_read_struct OSS_FUZZ_png_destroy_read_struct ------------------ 61| 15| return; 62| 15| } 63| | 64| | /* Target 1: 16-bit depth processing (triggers png_do_chop) */ 65| 493| if (bit_depth == 16) { ------------------ | Branch (65:9): [True: 493, False: 18.4E] ------------------ 66| 493| png_set_scale_16(png_ptr); ------------------ | | 431| 493|#define png_set_scale_16 OSS_FUZZ_png_set_scale_16 ------------------ 67| 493| } 68| | 69| | /* Target 2: Color quantization (triggers png_do_quantize) */ 70| 930| if (color_type == PNG_COLOR_TYPE_RGB || color_type == PNG_COLOR_TYPE_RGB_ALPHA) { ------------------ | | 668| 106|#define PNG_COLOR_TYPE_RGB (PNG_COLOR_MASK_COLOR) | | ------------------ | | | | 662| 53|#define PNG_COLOR_MASK_COLOR 2 | | ------------------ ------------------ if (color_type == PNG_COLOR_TYPE_RGB || color_type == PNG_COLOR_TYPE_RGB_ALPHA) { ------------------ | | 669| 930|#define PNG_COLOR_TYPE_RGB_ALPHA (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_ALPHA) | | ------------------ | | | | 662| 930|#define PNG_COLOR_MASK_COLOR 2 | | ------------------ | | #define PNG_COLOR_TYPE_RGB_ALPHA (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_ALPHA) | | ------------------ | | | | 663| 930|#define PNG_COLOR_MASK_ALPHA 4 | | ------------------ ------------------ | Branch (70:9): [True: 18.4E, False: 930] | Branch (70:45): [True: 185, False: 745] ------------------ 71| 505| palette = (png_colorp)malloc(256 * sizeof(png_color)); 72| 505| if (palette) { ------------------ | Branch (72:13): [True: 505, False: 0] ------------------ 73| 505| int i; 74| 129k| for (i = 0; i < 256; i++) { ------------------ | Branch (74:25): [True: 129k, False: 505] ------------------ 75| 129k| palette[i].red = palette[i].green = palette[i].blue = (png_byte)i; 76| 129k| } 77| 505| png_set_quantize(png_ptr, palette, 256, 256, NULL, 0); ------------------ | | 416| 505|#define png_set_quantize OSS_FUZZ_png_set_quantize ------------------ 78| 505| free((void*)palette); 79| 505| palette = NULL; 80| 505| } 81| 505| } 82| | 83| | /* Target 3: Alpha channel transformations */ 84| 341| if (color_type & PNG_COLOR_MASK_ALPHA) { ------------------ | | 663| 53|#define PNG_COLOR_MASK_ALPHA 4 ------------------ | Branch (84:9): [True: 341, False: 18.4E] ------------------ 85| 341| png_set_invert_alpha(png_ptr); /* png_do_read_invert_alpha */ ------------------ | | 401| 341|#define png_set_invert_alpha OSS_FUZZ_png_set_invert_alpha ------------------ 86| 341| png_set_swap_alpha(png_ptr); /* png_do_read_swap_alpha */ ------------------ | | 437| 341|#define png_set_swap_alpha OSS_FUZZ_png_set_swap_alpha ------------------ 87| 341| } 88| | 89| | /* Target 4: Bit shifting (triggers png_do_unshift) */ 90| 334| if (bit_depth < 8) { ------------------ | Branch (90:9): [True: 334, False: 18.4E] ------------------ 91| 334| png_set_packing(png_ptr); ------------------ | | 412| 334|#define png_set_packing OSS_FUZZ_png_set_packing ------------------ 92| 334| } 93| | 94| | /* Target 5: Alpha encoding (triggers png_do_encode_alpha) */ 95| 53| png_set_alpha_mode(png_ptr, PNG_ALPHA_STANDARD, PNG_GAMMA_LINEAR); ------------------ | | 366| 53|#define png_set_alpha_mode OSS_FUZZ_png_set_alpha_mode ------------------ png_set_alpha_mode(png_ptr, PNG_ALPHA_STANDARD, PNG_GAMMA_LINEAR); ------------------ | | 1173| 53|#define PNG_ALPHA_STANDARD 1 /* according to Porter/Duff */ ------------------ png_set_alpha_mode(png_ptr, PNG_ALPHA_STANDARD, PNG_GAMMA_LINEAR); ------------------ | | 1192| 53|#define PNG_GAMMA_LINEAR PNG_FP_1 /* Linear */ | | ------------------ | | | | 654| 53|#define PNG_FP_1 100000 | | ------------------ ------------------ 96| | 97| | /* Update transformations */ 98| 53| png_read_update_info(png_ptr, info_ptr); ------------------ | | 361| 53|#define png_read_update_info OSS_FUZZ_png_read_update_info ------------------ 99| | 100| | /* Read image data to execute transformations */ 101| 53| size_t rowbytes = png_get_rowbytes(png_ptr, info_ptr); ------------------ | | 308| 53|#define png_get_rowbytes OSS_FUZZ_png_get_rowbytes ------------------ 102| 53| row = (png_bytep)malloc(rowbytes); 103| 1.25k| if (row) { ------------------ | Branch (103:9): [True: 1.25k, False: 18.4E] ------------------ 104| 1.25k| int y; 105| 12.1k| for (y = 0; y < height && y < 100; y++) { /* Limit rows for performance */ ------------------ | Branch (105:21): [True: 10.9k, False: 1.24k] | Branch (105:35): [True: 10.9k, False: 4] ------------------ 106| 10.9k| png_read_row(png_ptr, row, NULL); ------------------ | | 359| 10.9k|#define png_read_row OSS_FUZZ_png_read_row ------------------ 107| 10.9k| } 108| 1.25k| } 109| | 110| 53| free((void*)row); 111| 53| png_destroy_read_struct(&png_ptr, &info_ptr, NULL); ------------------ | | 250| 53|#define png_destroy_read_struct OSS_FUZZ_png_destroy_read_struct ------------------ 112| 53|} libpng_transformations_fuzzer.cc:_ZL20png_read_from_bufferP14png_struct_defPhm: 15| 303k|static void png_read_from_buffer(png_structp png_ptr, png_bytep data, png_size_t length) { 16| 303k| struct png_mem_buffer *buf = (struct png_mem_buffer*)png_get_io_ptr(png_ptr); ------------------ | | 291| 303k|#define png_get_io_ptr OSS_FUZZ_png_get_io_ptr ------------------ 17| 303k| if (buf->pos + length > buf->size) { ------------------ | Branch (17:9): [True: 5.80k, False: 298k] ------------------ 18| 5.80k| png_error(png_ptr, "Read error"); ------------------ | | 252| 11.6k|#define png_error OSS_FUZZ_png_error ------------------ 19| 5.80k| } 20| 298k| memcpy(data, buf->data + buf->pos, length); 21| 298k| buf->pos += length; 22| 298k|} OSS_FUZZ_png_sig_cmp: 81| 6.59k|{ 82| 6.59k| static const png_byte png_signature[8] = {137, 80, 78, 71, 13, 10, 26, 10}; 83| | 84| 6.59k| if (num_to_check > 8) ------------------ | Branch (84:8): [True: 0, False: 6.59k] ------------------ 85| 0| num_to_check = 8; 86| | 87| 6.59k| else if (num_to_check < 1) ------------------ | Branch (87:13): [True: 0, False: 6.59k] ------------------ 88| 0| return -1; 89| | 90| 6.59k| if (start > 7) ------------------ | Branch (90:8): [True: 0, False: 6.59k] ------------------ 91| 0| return -1; 92| | 93| 6.59k| if (start + num_to_check > 8) ------------------ | Branch (93:8): [True: 0, False: 6.59k] ------------------ 94| 0| num_to_check = 8 - start; 95| | 96| 6.59k| return memcmp(&sig[start], &png_signature[start], num_to_check); 97| 6.59k|} OSS_FUZZ_png_zalloc: 106| 11.5k|{ 107| 11.5k| png_alloc_size_t num_bytes = size; 108| | 109| 11.5k| if (png_ptr == NULL) ------------------ | Branch (109:8): [True: 0, False: 11.5k] ------------------ 110| 0| return NULL; 111| | 112| | /* This check against overflow is vestigial, dating back from 113| | * the old times when png_zalloc used to be an exported function. 114| | * We're still keeping it here for now, as an extra-cautious 115| | * prevention against programming errors inside zlib, although it 116| | * should rather be a debug-time assertion instead. 117| | */ 118| 11.5k| if (size != 0 && items >= (~(png_alloc_size_t)0) / size) ------------------ | Branch (118:8): [True: 11.5k, False: 0] | Branch (118:21): [True: 0, False: 11.5k] ------------------ 119| 0| { 120| 0| png_warning(png_voidcast(png_structrp, png_ptr), ------------------ | | 450| 0|#define png_warning OSS_FUZZ_png_warning ------------------ png_warning(png_voidcast(png_structrp, png_ptr), ------------------ | | 535| 0|# define png_voidcast(type, value) (value) ------------------ 121| 0| "Potential overflow in png_zalloc()"); 122| 0| return NULL; 123| 0| } 124| | 125| 11.5k| num_bytes *= items; 126| 11.5k| return png_malloc_warn(png_voidcast(png_structrp, png_ptr), num_bytes); ------------------ | | 349| 11.5k|#define png_malloc_warn OSS_FUZZ_png_malloc_warn ------------------ return png_malloc_warn(png_voidcast(png_structrp, png_ptr), num_bytes); ------------------ | | 535| 11.5k|# define png_voidcast(type, value) (value) ------------------ 127| 11.5k|} OSS_FUZZ_png_zfree: 132| 11.5k|{ 133| 11.5k| png_free(png_voidcast(png_const_structrp,png_ptr), ptr); ------------------ | | 253| 11.5k|#define png_free OSS_FUZZ_png_free ------------------ png_free(png_voidcast(png_const_structrp,png_ptr), ptr); ------------------ | | 535| 11.5k|# define png_voidcast(type, value) (value) ------------------ 134| 11.5k|} OSS_FUZZ_png_reset_crc: 141| 97.9k|{ 142| | /* The cast is safe because the crc is a 32-bit value. */ 143| | png_ptr->crc = (png_uint_32)crc32(0, Z_NULL, 0); 144| 97.9k|} OSS_FUZZ_png_calculate_crc: 153| 198k|{ 154| 198k| int need_crc = 1; 155| | 156| 198k| if (PNG_CHUNK_ANCILLARY(png_ptr->chunk_name) != 0) ------------------ | | 941| 198k|#define PNG_CHUNK_ANCILLARY(c) (1 & ((c) >> 29)) ------------------ | Branch (156:8): [True: 181k, False: 16.7k] ------------------ 157| 181k| { 158| 181k| if ((png_ptr->flags & PNG_FLAG_CRC_ANCILLARY_MASK) == ------------------ | | 727| 181k|#define PNG_FLAG_CRC_ANCILLARY_MASK (PNG_FLAG_CRC_ANCILLARY_USE | \ | | ------------------ | | | | 703| 181k|#define PNG_FLAG_CRC_ANCILLARY_USE 0x0100U | | ------------------ | | 728| 181k| PNG_FLAG_CRC_ANCILLARY_NOWARN) | | ------------------ | | | | 704| 181k|#define PNG_FLAG_CRC_ANCILLARY_NOWARN 0x0200U | | ------------------ ------------------ | Branch (158:11): [True: 0, False: 181k] ------------------ 159| 181k| (PNG_FLAG_CRC_ANCILLARY_USE | PNG_FLAG_CRC_ANCILLARY_NOWARN)) ------------------ | | 703| 181k|#define PNG_FLAG_CRC_ANCILLARY_USE 0x0100U ------------------ (PNG_FLAG_CRC_ANCILLARY_USE | PNG_FLAG_CRC_ANCILLARY_NOWARN)) ------------------ | | 704| 181k|#define PNG_FLAG_CRC_ANCILLARY_NOWARN 0x0200U ------------------ 160| 0| need_crc = 0; 161| 181k| } 162| | 163| 16.7k| else /* critical */ 164| 16.7k| { 165| 16.7k| if ((png_ptr->flags & PNG_FLAG_CRC_CRITICAL_IGNORE) != 0) ------------------ | | 706| 16.7k|#define PNG_FLAG_CRC_CRITICAL_IGNORE 0x0800U ------------------ | Branch (165:11): [True: 0, False: 16.7k] ------------------ 166| 0| need_crc = 0; 167| 16.7k| } 168| | 169| | /* 'uLong' is defined in zlib.h as unsigned long; this means that on some 170| | * systems it is a 64-bit value. crc32, however, returns 32 bits so the 171| | * following cast is safe. 'uInt' may be no more than 16 bits, so it is 172| | * necessary to perform a loop here. 173| | */ 174| 198k| if (need_crc != 0 && length > 0) ------------------ | Branch (174:8): [True: 198k, False: 0] | Branch (174:25): [True: 198k, False: 5] ------------------ 175| 198k| { 176| 198k| uLong crc = png_ptr->crc; /* Should never issue a warning */ 177| | 178| 198k| do 179| 198k| { 180| 198k| uInt safe_length = (uInt)length; 181| 198k|#ifndef __COVERITY__ 182| 198k| if (safe_length == 0) ------------------ | Branch (182:14): [True: 0, False: 198k] ------------------ 183| 0| safe_length = (uInt)-1; /* evil, but safe */ 184| 198k|#endif 185| | 186| 198k| crc = crc32(crc, ptr, safe_length); 187| | 188| | /* The following should never issue compiler warnings; if they do the 189| | * target system has characteristics that will probably violate other 190| | * assumptions within the libpng code. 191| | */ 192| 198k| ptr += safe_length; 193| 198k| length -= safe_length; 194| 198k| } 195| 198k| while (length > 0); ------------------ | Branch (195:14): [True: 0, False: 198k] ------------------ 196| | 197| | /* And the following is always safe because the crc is only 32 bits. */ 198| 198k| png_ptr->crc = (png_uint_32)crc; 199| 198k| } 200| 198k|} OSS_FUZZ_png_user_version_check: 207| 6.52k|{ 208| | /* Libpng versions 1.0.0 and later are binary compatible if the version 209| | * string matches through the second '.'; we must recompile any 210| | * applications that use any older library version. 211| | */ 212| | 213| 6.52k| if (user_png_ver != NULL) ------------------ | Branch (213:8): [True: 6.52k, False: 0] ------------------ 214| 6.52k| { 215| 6.52k| int i = -1; 216| 6.52k| int found_dots = 0; 217| | 218| 6.52k| do 219| 26.1k| { 220| 26.1k| i++; 221| 26.1k| if (user_png_ver[i] != PNG_LIBPNG_VER_STRING[i]) ------------------ | | 277| 26.1k|#define PNG_LIBPNG_VER_STRING "1.6.59.git" ------------------ | Branch (221:14): [True: 0, False: 26.1k] ------------------ 222| 0| png_ptr->flags |= PNG_FLAG_LIBRARY_MISMATCH; ------------------ | | 712| 0|#define PNG_FLAG_LIBRARY_MISMATCH 0x20000U ------------------ 223| 26.1k| if (user_png_ver[i] == '.') ------------------ | Branch (223:14): [True: 13.0k, False: 13.0k] ------------------ 224| 13.0k| found_dots++; 225| 26.1k| } while (found_dots < 2 && user_png_ver[i] != 0 && ------------------ | Branch (225:16): [True: 19.5k, False: 6.52k] | Branch (225:34): [True: 19.5k, False: 0] ------------------ 226| 19.5k| PNG_LIBPNG_VER_STRING[i] != 0); ------------------ | | 277| 19.5k|#define PNG_LIBPNG_VER_STRING "1.6.59.git" ------------------ | Branch (226:13): [True: 19.5k, False: 0] ------------------ 227| 6.52k| } 228| | 229| 0| else 230| 0| png_ptr->flags |= PNG_FLAG_LIBRARY_MISMATCH; ------------------ | | 712| 0|#define PNG_FLAG_LIBRARY_MISMATCH 0x20000U ------------------ 231| | 232| 6.52k| if ((png_ptr->flags & PNG_FLAG_LIBRARY_MISMATCH) != 0) ------------------ | | 712| 6.52k|#define PNG_FLAG_LIBRARY_MISMATCH 0x20000U ------------------ | Branch (232:8): [True: 0, False: 6.52k] ------------------ 233| 0| { 234| 0|#ifdef PNG_WARNINGS_SUPPORTED 235| 0| size_t pos = 0; 236| 0| char m[128]; 237| | 238| 0| pos = png_safecat(m, (sizeof m), pos, ------------------ | | 75| 0|#define png_safecat OSS_FUZZ_png_safecat ------------------ 239| 0| "Application built with libpng-"); 240| 0| pos = png_safecat(m, (sizeof m), pos, user_png_ver); ------------------ | | 75| 0|#define png_safecat OSS_FUZZ_png_safecat ------------------ 241| 0| pos = png_safecat(m, (sizeof m), pos, " but running with "); ------------------ | | 75| 0|#define png_safecat OSS_FUZZ_png_safecat ------------------ 242| 0| pos = png_safecat(m, (sizeof m), pos, PNG_LIBPNG_VER_STRING); ------------------ | | 75| 0|#define png_safecat OSS_FUZZ_png_safecat ------------------ pos = png_safecat(m, (sizeof m), pos, PNG_LIBPNG_VER_STRING); ------------------ | | 277| 0|#define PNG_LIBPNG_VER_STRING "1.6.59.git" ------------------ 243| 0| PNG_UNUSED(pos) ------------------ | | 479| 0|# define PNG_UNUSED(param) (void)param; ------------------ 244| | 245| 0| png_warning(png_ptr, m); ------------------ | | 450| 0|#define png_warning OSS_FUZZ_png_warning ------------------ 246| 0|#endif 247| | 248| 0| return 0; 249| 0| } 250| | 251| | /* Success return. */ 252| 6.52k| return 1; 253| 6.52k|} OSS_FUZZ_png_create_png_struct: 263| 6.52k|{ 264| 6.52k| png_struct create_struct; 265| 6.52k|# ifdef PNG_SETJMP_SUPPORTED 266| 6.52k| jmp_buf create_jmp_buf; 267| 6.52k|# endif 268| | 269| | /* This temporary stack-allocated structure is used to provide a place to 270| | * build enough context to allow the user provided memory allocator (if any) 271| | * to be called. 272| | */ 273| 6.52k| memset(&create_struct, 0, (sizeof create_struct)); 274| | 275| 6.52k|# ifdef PNG_USER_LIMITS_SUPPORTED 276| 6.52k| create_struct.user_width_max = PNG_USER_WIDTH_MAX; ------------------ | | 225| 6.52k|#define PNG_USER_WIDTH_MAX 1000000 ------------------ 277| 6.52k| create_struct.user_height_max = PNG_USER_HEIGHT_MAX; ------------------ | | 224| 6.52k|#define PNG_USER_HEIGHT_MAX 1000000 ------------------ 278| | 279| 6.52k|# ifdef PNG_USER_CHUNK_CACHE_MAX 280| 6.52k| create_struct.user_chunk_cache_max = PNG_USER_CHUNK_CACHE_MAX; ------------------ | | 222| 6.52k|#define PNG_USER_CHUNK_CACHE_MAX 1000 ------------------ 281| 6.52k|# endif 282| | 283| 6.52k|# if PNG_USER_CHUNK_MALLOC_MAX > 0 /* default to compile-time limit */ 284| 6.52k| create_struct.user_chunk_malloc_max = PNG_USER_CHUNK_MALLOC_MAX; ------------------ | | 223| 6.52k|#define PNG_USER_CHUNK_MALLOC_MAX 8000000 ------------------ 285| | 286| | /* No compile-time limit, so initialize to the system limit: */ 287| |# elif defined PNG_MAX_MALLOC_64K /* legacy system limit */ 288| | create_struct.user_chunk_malloc_max = 65536U; 289| | 290| |# else /* modern system limit SIZE_MAX (C99) */ 291| | create_struct.user_chunk_malloc_max = PNG_SIZE_MAX; 292| |# endif 293| 6.52k|# endif 294| | 295| | /* The following two API calls simply set fields in png_struct, so it is safe 296| | * to do them now even though error handling is not yet set up. 297| | */ 298| 6.52k|# ifdef PNG_USER_MEM_SUPPORTED 299| 6.52k| png_set_mem_fn(&create_struct, mem_ptr, malloc_fn, free_fn); ------------------ | | 407| 6.52k|#define png_set_mem_fn OSS_FUZZ_png_set_mem_fn ------------------ 300| |# else 301| | PNG_UNUSED(mem_ptr) 302| | PNG_UNUSED(malloc_fn) 303| | PNG_UNUSED(free_fn) 304| |# endif 305| | 306| | /* (*error_fn) can return control to the caller after the error_ptr is set, 307| | * this will result in a memory leak unless the error_fn does something 308| | * extremely sophisticated. The design lacks merit but is implicit in the 309| | * API. 310| | */ 311| 6.52k| png_set_error_fn(&create_struct, error_ptr, error_fn, warn_fn); ------------------ | | 387| 6.52k|#define png_set_error_fn OSS_FUZZ_png_set_error_fn ------------------ 312| | 313| 6.52k|# ifdef PNG_SETJMP_SUPPORTED 314| 6.52k| if (!setjmp(create_jmp_buf)) ------------------ | Branch (314:11): [True: 6.52k, False: 0] ------------------ 315| 6.52k|# endif 316| 6.52k| { 317| 6.52k|# ifdef PNG_SETJMP_SUPPORTED 318| | /* Temporarily fake out the longjmp information until we have 319| | * successfully completed this function. This only works if we have 320| | * setjmp() support compiled in, but it is safe - this stuff should 321| | * never happen. 322| | */ 323| 6.52k| create_struct.jmp_buf_ptr = &create_jmp_buf; 324| 6.52k| create_struct.jmp_buf_size = 0; /*stack allocation*/ 325| 6.52k| create_struct.longjmp_fn = longjmp; 326| 6.52k|# endif 327| | /* Call the general version checker (shared with read and write code): 328| | */ 329| 6.52k| if (png_user_version_check(&create_struct, user_png_ver) != 0) ------------------ | | 7| 6.52k|#define png_user_version_check OSS_FUZZ_png_user_version_check ------------------ | Branch (329:14): [True: 6.52k, False: 0] ------------------ 330| 6.52k| { 331| 6.52k| png_structrp png_ptr = png_voidcast(png_structrp, ------------------ | | 535| 6.52k|# define png_voidcast(type, value) (value) ------------------ 332| 6.52k| png_malloc_warn(&create_struct, (sizeof *png_ptr))); 333| | 334| 6.52k| if (png_ptr != NULL) ------------------ | Branch (334:17): [True: 6.52k, False: 0] ------------------ 335| 6.52k| { 336| | /* png_ptr->zstream holds a back-pointer to the png_struct, so 337| | * this can only be done now: 338| | */ 339| 6.52k| create_struct.zstream.zalloc = png_zalloc; ------------------ | | 14| 6.52k|#define png_zalloc OSS_FUZZ_png_zalloc ------------------ 340| 6.52k| create_struct.zstream.zfree = png_zfree; ------------------ | | 15| 6.52k|#define png_zfree OSS_FUZZ_png_zfree ------------------ 341| 6.52k| create_struct.zstream.opaque = png_ptr; 342| | 343| 6.52k|# ifdef PNG_SETJMP_SUPPORTED 344| | /* Eliminate the local error handling: */ 345| 6.52k| create_struct.jmp_buf_ptr = NULL; 346| 6.52k| create_struct.jmp_buf_size = 0; 347| 6.52k| create_struct.longjmp_fn = 0; 348| 6.52k|# endif 349| | 350| 6.52k| *png_ptr = create_struct; 351| | 352| | /* This is the successful return point */ 353| 6.52k| return png_ptr; 354| 6.52k| } 355| 6.52k| } 356| 6.52k| } 357| | 358| | /* A longjmp because of a bug in the application storage allocator or a 359| | * simple failure to allocate the png_struct. 360| | */ 361| 0| return NULL; 362| 6.52k|} OSS_FUZZ_png_create_info_struct: 368| 6.52k|{ 369| 6.52k| png_inforp info_ptr; 370| | 371| 6.52k| png_debug(1, "in png_create_info_struct"); ------------------ | | 145| 6.52k|# define png_debug(l, m) ((void)0) ------------------ 372| | 373| 6.52k| if (png_ptr == NULL) ------------------ | Branch (373:8): [True: 0, False: 6.52k] ------------------ 374| 0| return NULL; 375| | 376| | /* Use the internal API that does not (or at least should not) error out, so 377| | * that this call always returns ok. The application typically sets up the 378| | * error handling *after* creating the info_struct because this is the way it 379| | * has always been done in 'example.c'. 380| | */ 381| 6.52k| info_ptr = png_voidcast(png_inforp, png_malloc_base(png_ptr, ------------------ | | 535| 6.52k|# define png_voidcast(type, value) (value) ------------------ 382| 6.52k| (sizeof *info_ptr))); 383| | 384| 6.52k| if (info_ptr != NULL) ------------------ | Branch (384:8): [True: 6.52k, False: 0] ------------------ 385| 6.52k| memset(info_ptr, 0, (sizeof *info_ptr)); 386| | 387| 6.52k| return info_ptr; 388| 6.52k|} OSS_FUZZ_png_destroy_info_struct: 400| 13.0k|{ 401| 13.0k| png_inforp info_ptr = NULL; 402| | 403| 13.0k| png_debug(1, "in png_destroy_info_struct"); ------------------ | | 145| 13.0k|# define png_debug(l, m) ((void)0) ------------------ 404| | 405| 13.0k| if (png_ptr == NULL) ------------------ | Branch (405:8): [True: 0, False: 13.0k] ------------------ 406| 0| return; 407| | 408| 13.0k| if (info_ptr_ptr != NULL) ------------------ | Branch (408:8): [True: 6.52k, False: 6.52k] ------------------ 409| 6.52k| info_ptr = *info_ptr_ptr; 410| | 411| 13.0k| if (info_ptr != NULL) ------------------ | Branch (411:8): [True: 6.52k, False: 6.52k] ------------------ 412| 6.52k| { 413| | /* Do this first in case of an error below; if the app implements its own 414| | * memory management this can lead to png_free calling png_error, which 415| | * will abort this routine and return control to the app error handler. 416| | * An infinite loop may result if it then tries to free the same info 417| | * ptr. 418| | */ 419| 6.52k| *info_ptr_ptr = NULL; 420| | 421| 6.52k| png_free_data(png_ptr, info_ptr, PNG_FREE_ALL, -1); ------------------ | | 254| 6.52k|#define png_free_data OSS_FUZZ_png_free_data ------------------ png_free_data(png_ptr, info_ptr, PNG_FREE_ALL, -1); ------------------ | | 1852| 6.52k|#define PNG_FREE_ALL 0xffffU ------------------ 422| 6.52k| memset(info_ptr, 0, (sizeof *info_ptr)); 423| 6.52k| png_free(png_ptr, info_ptr); ------------------ | | 253| 6.52k|#define png_free OSS_FUZZ_png_free ------------------ 424| 6.52k| } 425| 13.0k|} OSS_FUZZ_png_free_data: 485| 7.32k|{ 486| 7.32k| png_debug(1, "in png_free_data"); ------------------ | | 145| 7.32k|# define png_debug(l, m) ((void)0) ------------------ 487| | 488| 7.32k| if (png_ptr == NULL || info_ptr == NULL) ------------------ | Branch (488:8): [True: 0, False: 7.32k] | Branch (488:27): [True: 0, False: 7.32k] ------------------ 489| 0| return; 490| | 491| 7.32k|#ifdef PNG_TEXT_SUPPORTED 492| | /* Free text item num or (if num == -1) all text items */ 493| 7.32k| if (info_ptr->text != NULL && ------------------ | Branch (493:8): [True: 186, False: 7.14k] ------------------ 494| 186| ((mask & PNG_FREE_TEXT) & info_ptr->free_me) != 0) ------------------ | | 1850| 186|#define PNG_FREE_TEXT 0x4000U ------------------ | Branch (494:8): [True: 179, False: 7] ------------------ 495| 179| { 496| 179| if (num != -1) ------------------ | Branch (496:11): [True: 0, False: 179] ------------------ 497| 0| { 498| 0| png_free(png_ptr, info_ptr->text[num].key); ------------------ | | 253| 0|#define png_free OSS_FUZZ_png_free ------------------ 499| 0| info_ptr->text[num].key = NULL; 500| 0| } 501| | 502| 179| else 503| 179| { 504| 179| int i; 505| | 506| 12.8k| for (i = 0; i < info_ptr->num_text; i++) ------------------ | Branch (506:22): [True: 12.6k, False: 179] ------------------ 507| 12.6k| png_free(png_ptr, info_ptr->text[i].key); ------------------ | | 253| 12.6k|#define png_free OSS_FUZZ_png_free ------------------ 508| | 509| 179| png_free(png_ptr, info_ptr->text); ------------------ | | 253| 179|#define png_free OSS_FUZZ_png_free ------------------ 510| 179| info_ptr->text = NULL; 511| 179| info_ptr->num_text = 0; 512| 179| info_ptr->max_text = 0; 513| 179| } 514| 179| } 515| 7.32k|#endif 516| | 517| 7.32k|#ifdef PNG_tRNS_SUPPORTED 518| | /* Free any tRNS entry */ 519| 7.32k| if (((mask & PNG_FREE_TRNS) & info_ptr->free_me) != 0) ------------------ | | 1849| 7.32k|#define PNG_FREE_TRNS 0x2000U ------------------ | Branch (519:8): [True: 598, False: 6.73k] ------------------ 520| 598| { 521| 598| info_ptr->valid &= ~PNG_INFO_tRNS; ------------------ | | 734| 598|#define PNG_INFO_tRNS 0x0010U ------------------ 522| 598| png_free(png_ptr, info_ptr->trans_alpha); ------------------ | | 253| 598|#define png_free OSS_FUZZ_png_free ------------------ 523| 598| info_ptr->trans_alpha = NULL; 524| 598| info_ptr->num_trans = 0; 525| 598| } 526| 7.32k|#endif 527| | 528| 7.32k|#ifdef PNG_sCAL_SUPPORTED 529| | /* Free any sCAL entry */ 530| 7.32k| if (((mask & PNG_FREE_SCAL) & info_ptr->free_me) != 0) ------------------ | | 1843| 7.32k|#define PNG_FREE_SCAL 0x0100U ------------------ | Branch (530:8): [True: 6, False: 7.32k] ------------------ 531| 6| { 532| 6| png_free(png_ptr, info_ptr->scal_s_width); ------------------ | | 253| 6|#define png_free OSS_FUZZ_png_free ------------------ 533| 6| png_free(png_ptr, info_ptr->scal_s_height); ------------------ | | 253| 6|#define png_free OSS_FUZZ_png_free ------------------ 534| 6| info_ptr->scal_s_width = NULL; 535| 6| info_ptr->scal_s_height = NULL; 536| 6| info_ptr->valid &= ~PNG_INFO_sCAL; ------------------ | | 744| 6|#define PNG_INFO_sCAL 0x4000U /* ESR, 1.0.6 */ ------------------ 537| 6| } 538| 7.32k|#endif 539| | 540| 7.32k|#ifdef PNG_pCAL_SUPPORTED 541| | /* Free any pCAL entry */ 542| 7.32k| if (((mask & PNG_FREE_PCAL) & info_ptr->free_me) != 0) ------------------ | | 1842| 7.32k|#define PNG_FREE_PCAL 0x0080U ------------------ | Branch (542:8): [True: 4, False: 7.32k] ------------------ 543| 4| { 544| 4| png_free(png_ptr, info_ptr->pcal_purpose); ------------------ | | 253| 4|#define png_free OSS_FUZZ_png_free ------------------ 545| 4| png_free(png_ptr, info_ptr->pcal_units); ------------------ | | 253| 4|#define png_free OSS_FUZZ_png_free ------------------ 546| 4| info_ptr->pcal_purpose = NULL; 547| 4| info_ptr->pcal_units = NULL; 548| | 549| 4| if (info_ptr->pcal_params != NULL) ------------------ | Branch (549:11): [True: 4, False: 0] ------------------ 550| 4| { 551| 4| int i; 552| | 553| 12| for (i = 0; i < info_ptr->pcal_nparams; i++) ------------------ | Branch (553:25): [True: 8, False: 4] ------------------ 554| 8| png_free(png_ptr, info_ptr->pcal_params[i]); ------------------ | | 253| 8|#define png_free OSS_FUZZ_png_free ------------------ 555| | 556| 4| png_free(png_ptr, info_ptr->pcal_params); ------------------ | | 253| 4|#define png_free OSS_FUZZ_png_free ------------------ 557| 4| info_ptr->pcal_params = NULL; 558| 4| } 559| 4| info_ptr->valid &= ~PNG_INFO_pCAL; ------------------ | | 740| 4|#define PNG_INFO_pCAL 0x0400U ------------------ 560| 4| } 561| 7.32k|#endif 562| | 563| 7.32k|#ifdef PNG_iCCP_SUPPORTED 564| | /* Free any profile entry */ 565| 7.32k| if (((mask & PNG_FREE_ICCP) & info_ptr->free_me) != 0) ------------------ | | 1839| 7.32k|#define PNG_FREE_ICCP 0x0010U ------------------ | Branch (565:8): [True: 9, False: 7.32k] ------------------ 566| 9| { 567| 9| png_free(png_ptr, info_ptr->iccp_name); ------------------ | | 253| 9|#define png_free OSS_FUZZ_png_free ------------------ 568| 9| png_free(png_ptr, info_ptr->iccp_profile); ------------------ | | 253| 9|#define png_free OSS_FUZZ_png_free ------------------ 569| 9| info_ptr->iccp_name = NULL; 570| 9| info_ptr->iccp_profile = NULL; 571| 9| info_ptr->valid &= ~PNG_INFO_iCCP; ------------------ | | 742| 9|#define PNG_INFO_iCCP 0x1000U /* ESR, 1.0.6 */ ------------------ 572| 9| } 573| 7.32k|#endif 574| | 575| 7.32k|#ifdef PNG_sPLT_SUPPORTED 576| | /* Free a given sPLT entry, or (if num == -1) all sPLT entries */ 577| 7.32k| if (info_ptr->splt_palettes != NULL && ------------------ | Branch (577:8): [True: 44, False: 7.28k] ------------------ 578| 44| ((mask & PNG_FREE_SPLT) & info_ptr->free_me) != 0) ------------------ | | 1840| 44|#define PNG_FREE_SPLT 0x0020U ------------------ | Branch (578:8): [True: 35, False: 9] ------------------ 579| 35| { 580| 35| if (num != -1) ------------------ | Branch (580:11): [True: 0, False: 35] ------------------ 581| 0| { 582| 0| png_free(png_ptr, info_ptr->splt_palettes[num].name); ------------------ | | 253| 0|#define png_free OSS_FUZZ_png_free ------------------ 583| 0| png_free(png_ptr, info_ptr->splt_palettes[num].entries); ------------------ | | 253| 0|#define png_free OSS_FUZZ_png_free ------------------ 584| 0| info_ptr->splt_palettes[num].name = NULL; 585| 0| info_ptr->splt_palettes[num].entries = NULL; 586| 0| } 587| | 588| 35| else 589| 35| { 590| 35| int i; 591| | 592| 1.20k| for (i = 0; i < info_ptr->splt_palettes_num; i++) ------------------ | Branch (592:22): [True: 1.17k, False: 35] ------------------ 593| 1.17k| { 594| 1.17k| png_free(png_ptr, info_ptr->splt_palettes[i].name); ------------------ | | 253| 1.17k|#define png_free OSS_FUZZ_png_free ------------------ 595| 1.17k| png_free(png_ptr, info_ptr->splt_palettes[i].entries); ------------------ | | 253| 1.17k|#define png_free OSS_FUZZ_png_free ------------------ 596| 1.17k| } 597| | 598| 35| png_free(png_ptr, info_ptr->splt_palettes); ------------------ | | 253| 35|#define png_free OSS_FUZZ_png_free ------------------ 599| 35| info_ptr->splt_palettes = NULL; 600| 35| info_ptr->splt_palettes_num = 0; 601| 35| info_ptr->valid &= ~PNG_INFO_sPLT; ------------------ | | 743| 35|#define PNG_INFO_sPLT 0x2000U /* ESR, 1.0.6 */ ------------------ 602| 35| } 603| 35| } 604| 7.32k|#endif 605| | 606| 7.32k|#ifdef PNG_STORE_UNKNOWN_CHUNKS_SUPPORTED 607| 7.32k| if (info_ptr->unknown_chunks != NULL && ------------------ | Branch (607:8): [True: 0, False: 7.32k] ------------------ 608| 0| ((mask & PNG_FREE_UNKN) & info_ptr->free_me) != 0) ------------------ | | 1845| 0|# define PNG_FREE_UNKN 0x0200U ------------------ | Branch (608:8): [True: 0, False: 0] ------------------ 609| 0| { 610| 0| if (num != -1) ------------------ | Branch (610:11): [True: 0, False: 0] ------------------ 611| 0| { 612| 0| png_free(png_ptr, info_ptr->unknown_chunks[num].data); ------------------ | | 253| 0|#define png_free OSS_FUZZ_png_free ------------------ 613| 0| info_ptr->unknown_chunks[num].data = NULL; 614| 0| } 615| | 616| 0| else 617| 0| { 618| 0| int i; 619| | 620| 0| for (i = 0; i < info_ptr->unknown_chunks_num; i++) ------------------ | Branch (620:22): [True: 0, False: 0] ------------------ 621| 0| png_free(png_ptr, info_ptr->unknown_chunks[i].data); ------------------ | | 253| 0|#define png_free OSS_FUZZ_png_free ------------------ 622| | 623| 0| png_free(png_ptr, info_ptr->unknown_chunks); ------------------ | | 253| 0|#define png_free OSS_FUZZ_png_free ------------------ 624| 0| info_ptr->unknown_chunks = NULL; 625| 0| info_ptr->unknown_chunks_num = 0; 626| 0| } 627| 0| } 628| 7.32k|#endif 629| | 630| 7.32k|#ifdef PNG_eXIf_SUPPORTED 631| | /* Free any eXIf entry */ 632| 7.32k| if (((mask & PNG_FREE_EXIF) & info_ptr->free_me) != 0) ------------------ | | 1851| 7.32k|#define PNG_FREE_EXIF 0x8000U /* Added at libpng-1.6.31 */ ------------------ | Branch (632:8): [True: 6, False: 7.32k] ------------------ 633| 6| { 634| 6| if (info_ptr->exif) ------------------ | Branch (634:11): [True: 6, False: 0] ------------------ 635| 6| { 636| 6| png_free(png_ptr, info_ptr->exif); ------------------ | | 253| 6|#define png_free OSS_FUZZ_png_free ------------------ 637| 6| info_ptr->exif = NULL; 638| 6| } 639| 6| info_ptr->valid &= ~PNG_INFO_eXIf; ------------------ | | 746| 6|#define PNG_INFO_eXIf 0x10000U /* GR-P, 1.6.31 */ ------------------ 640| 6| } 641| 7.32k|#endif 642| | 643| 7.32k|#ifdef PNG_hIST_SUPPORTED 644| | /* Free any hIST entry */ 645| 7.32k| if (((mask & PNG_FREE_HIST) & info_ptr->free_me) != 0) ------------------ | | 1838| 7.32k|#define PNG_FREE_HIST 0x0008U ------------------ | Branch (645:8): [True: 0, False: 7.32k] ------------------ 646| 0| { 647| 0| png_free(png_ptr, info_ptr->hist); ------------------ | | 253| 0|#define png_free OSS_FUZZ_png_free ------------------ 648| 0| info_ptr->hist = NULL; 649| 0| info_ptr->valid &= ~PNG_INFO_hIST; ------------------ | | 736| 0|#define PNG_INFO_hIST 0x0040U ------------------ 650| 0| } 651| 7.32k|#endif 652| | 653| | /* Free any PLTE entry that was internally allocated */ 654| 7.32k| if (((mask & PNG_FREE_PLTE) & info_ptr->free_me) != 0) ------------------ | | 1848| 7.32k|#define PNG_FREE_PLTE 0x1000U ------------------ | Branch (654:8): [True: 187, False: 7.14k] ------------------ 655| 187| { 656| 187| png_free(png_ptr, info_ptr->palette); ------------------ | | 253| 187|#define png_free OSS_FUZZ_png_free ------------------ 657| 187| info_ptr->palette = NULL; 658| 187| info_ptr->valid &= ~PNG_INFO_PLTE; ------------------ | | 733| 187|#define PNG_INFO_PLTE 0x0008U ------------------ 659| 187| info_ptr->num_palette = 0; 660| 187| } 661| | 662| 7.32k|#ifdef PNG_INFO_IMAGE_SUPPORTED 663| | /* Free any image bits attached to the info structure */ 664| 7.32k| if (((mask & PNG_FREE_ROWS) & info_ptr->free_me) != 0) ------------------ | | 1841| 7.32k|#define PNG_FREE_ROWS 0x0040U ------------------ | Branch (664:8): [True: 0, False: 7.32k] ------------------ 665| 0| { 666| 0| if (info_ptr->row_pointers != NULL) ------------------ | Branch (666:11): [True: 0, False: 0] ------------------ 667| 0| { 668| 0| png_uint_32 row; 669| 0| for (row = 0; row < info_ptr->height; row++) ------------------ | Branch (669:24): [True: 0, False: 0] ------------------ 670| 0| png_free(png_ptr, info_ptr->row_pointers[row]); ------------------ | | 253| 0|#define png_free OSS_FUZZ_png_free ------------------ 671| | 672| 0| png_free(png_ptr, info_ptr->row_pointers); ------------------ | | 253| 0|#define png_free OSS_FUZZ_png_free ------------------ 673| 0| info_ptr->row_pointers = NULL; 674| 0| } 675| 0| info_ptr->valid &= ~PNG_INFO_IDAT; ------------------ | | 745| 0|#define PNG_INFO_IDAT 0x8000U /* ESR, 1.0.6 */ ------------------ 676| 0| } 677| 7.32k|#endif 678| | 679| 7.32k| if (num != -1) ------------------ | Branch (679:8): [True: 800, False: 6.52k] ------------------ 680| 800| mask &= ~PNG_FREE_MUL; ------------------ | | 1853| 800|#define PNG_FREE_MUL 0x4220U /* PNG_FREE_SPLT|PNG_FREE_TEXT|PNG_FREE_UNKN */ ------------------ 681| | 682| 7.32k| info_ptr->free_me &= ~mask; 683| 7.32k|} OSS_FUZZ_png_get_io_ptr: 692| 303k|{ 693| 303k| if (png_ptr == NULL) ------------------ | Branch (693:8): [True: 0, False: 303k] ------------------ 694| 0| return NULL; 695| | 696| 303k| return png_ptr->io_ptr; 697| 303k|} OSS_FUZZ_png_handle_as_unknown: 932| 92.2k|{ 933| | /* Check chunk_name and return "keep" value if it's on the list, else 0 */ 934| 92.2k| png_const_bytep p, p_end; 935| | 936| 92.2k| if (png_ptr == NULL || chunk_name == NULL || png_ptr->num_chunk_list == 0) ------------------ | Branch (936:8): [True: 0, False: 92.2k] | Branch (936:27): [True: 0, False: 92.2k] | Branch (936:49): [True: 92.2k, False: 0] ------------------ 937| 92.2k| return PNG_HANDLE_CHUNK_AS_DEFAULT; ------------------ | | 2583| 92.2k|#define PNG_HANDLE_CHUNK_AS_DEFAULT 0 ------------------ 938| | 939| 0| p_end = png_ptr->chunk_list; 940| 0| p = p_end + png_ptr->num_chunk_list*5; /* beyond end */ 941| | 942| | /* The code is the fifth byte after each four byte string. Historically this 943| | * code was always searched from the end of the list, this is no longer 944| | * necessary because the 'set' routine handles duplicate entries correctly. 945| | */ 946| 0| do /* num_chunk_list > 0, so at least one */ 947| 0| { 948| 0| p -= 5; 949| | 950| 0| if (memcmp(chunk_name, p, 4) == 0) ------------------ | Branch (950:11): [True: 0, False: 0] ------------------ 951| 0| return p[4]; 952| 0| } 953| 0| while (p > p_end); ------------------ | Branch (953:11): [True: 0, False: 0] ------------------ 954| | 955| | /* This means that known chunks should be processed and unknown chunks should 956| | * be handled according to the value of png_ptr->unknown_default; this can be 957| | * confusing because, as a result, there are two levels of defaulting for 958| | * unknown chunks. 959| | */ 960| 0| return PNG_HANDLE_CHUNK_AS_DEFAULT; ------------------ | | 2583| 0|#define PNG_HANDLE_CHUNK_AS_DEFAULT 0 ------------------ 961| 0|} OSS_FUZZ_png_chunk_unknown_handling: 967| 92.2k|{ 968| 92.2k| png_byte chunk_string[5]; 969| | 970| 92.2k| PNG_CSTRING_FROM_CHUNK(chunk_string, chunk_name); ------------------ | | 938| 92.2k| (void)(PNG_STRING_FROM_CHUNK(s,c), ((char*)(s))[4] = 0) | | ------------------ | | | | 931| 92.2k| (void)(((char*)(s))[0]=(char)(((c)>>24) & 0xff), \ | | | | 932| 92.2k| ((char*)(s))[1]=(char)(((c)>>16) & 0xff),\ | | | | 933| 92.2k| ((char*)(s))[2]=(char)(((c)>>8) & 0xff), \ | | | | 934| 92.2k| ((char*)(s))[3]=(char)((c & 0xff))) | | ------------------ ------------------ 971| 92.2k| return png_handle_as_unknown(png_ptr, chunk_string); ------------------ | | 341| 92.2k|#define png_handle_as_unknown OSS_FUZZ_png_handle_as_unknown ------------------ 972| 92.2k|} OSS_FUZZ_png_zstream_error: 1004| 13.6k|{ 1005| | /* Translate 'ret' into an appropriate error string, priority is given to the 1006| | * one in zstream if set. This always returns a string, even in cases like 1007| | * Z_OK or Z_STREAM_END where the error code is a success code. 1008| | */ 1009| 13.6k| if (png_ptr->zstream.msg == NULL) switch (ret) ------------------ | Branch (1009:8): [True: 8.32k, False: 5.32k] ------------------ 1010| 8.32k| { 1011| 0| default: ------------------ | Branch (1011:7): [True: 0, False: 8.32k] ------------------ 1012| 6.63k| case Z_OK: ------------------ | Branch (1012:7): [True: 6.63k, False: 1.69k] ------------------ 1013| 6.63k| png_ptr->zstream.msg = PNGZ_MSG_CAST("unexpected zlib return code"); ------------------ | | 40| 6.63k|# define PNGZ_MSG_CAST(s) (s) ------------------ 1014| 6.63k| break; 1015| | 1016| 796| case Z_STREAM_END: ------------------ | Branch (1016:7): [True: 796, False: 7.52k] ------------------ 1017| | /* Normal exit */ 1018| 796| png_ptr->zstream.msg = PNGZ_MSG_CAST("unexpected end of LZ stream"); ------------------ | | 40| 796|# define PNGZ_MSG_CAST(s) (s) ------------------ 1019| 796| break; 1020| | 1021| 2| case Z_NEED_DICT: ------------------ | Branch (1021:7): [True: 2, False: 8.32k] ------------------ 1022| | /* This means the deflate stream did not have a dictionary; this 1023| | * indicates a bogus PNG. 1024| | */ 1025| 2| png_ptr->zstream.msg = PNGZ_MSG_CAST("missing LZ dictionary"); ------------------ | | 40| 2|# define PNGZ_MSG_CAST(s) (s) ------------------ 1026| 2| break; 1027| | 1028| 0| case Z_ERRNO: ------------------ | Branch (1028:7): [True: 0, False: 8.32k] ------------------ 1029| | /* gz APIs only: should not happen */ 1030| 0| png_ptr->zstream.msg = PNGZ_MSG_CAST("zlib IO error"); ------------------ | | 40| 0|# define PNGZ_MSG_CAST(s) (s) ------------------ 1031| 0| break; 1032| | 1033| 0| case Z_STREAM_ERROR: ------------------ | Branch (1033:7): [True: 0, False: 8.32k] ------------------ 1034| | /* internal libpng error */ 1035| 0| png_ptr->zstream.msg = PNGZ_MSG_CAST("bad parameters to zlib"); ------------------ | | 40| 0|# define PNGZ_MSG_CAST(s) (s) ------------------ 1036| 0| break; 1037| | 1038| 0| case Z_DATA_ERROR: ------------------ | Branch (1038:7): [True: 0, False: 8.32k] ------------------ 1039| 0| png_ptr->zstream.msg = PNGZ_MSG_CAST("damaged LZ stream"); ------------------ | | 40| 0|# define PNGZ_MSG_CAST(s) (s) ------------------ 1040| 0| break; 1041| | 1042| 0| case Z_MEM_ERROR: ------------------ | Branch (1042:7): [True: 0, False: 8.32k] ------------------ 1043| 0| png_ptr->zstream.msg = PNGZ_MSG_CAST("insufficient memory"); ------------------ | | 40| 0|# define PNGZ_MSG_CAST(s) (s) ------------------ 1044| 0| break; 1045| | 1046| 892| case Z_BUF_ERROR: ------------------ | Branch (1046:7): [True: 892, False: 7.43k] ------------------ 1047| | /* End of input or output; not a problem if the caller is doing 1048| | * incremental read or write. 1049| | */ 1050| 892| png_ptr->zstream.msg = PNGZ_MSG_CAST("truncated"); ------------------ | | 40| 892|# define PNGZ_MSG_CAST(s) (s) ------------------ 1051| 892| break; 1052| | 1053| 0| case Z_VERSION_ERROR: ------------------ | Branch (1053:7): [True: 0, False: 8.32k] ------------------ 1054| 0| png_ptr->zstream.msg = PNGZ_MSG_CAST("unsupported zlib version"); ------------------ | | 40| 0|# define PNGZ_MSG_CAST(s) (s) ------------------ 1055| 0| break; 1056| | 1057| 0| case PNG_UNEXPECTED_ZLIB_RETURN: ------------------ | | 1077| 0|#define PNG_UNEXPECTED_ZLIB_RETURN (-7) ------------------ | Branch (1057:7): [True: 0, False: 8.32k] ------------------ 1058| | /* Compile errors here mean that zlib now uses the value co-opted in 1059| | * pngpriv.h for PNG_UNEXPECTED_ZLIB_RETURN; update the switch above 1060| | * and change pngpriv.h. Note that this message is "... return", 1061| | * whereas the default/Z_OK one is "... return code". 1062| | */ 1063| 0| png_ptr->zstream.msg = PNGZ_MSG_CAST("unexpected zlib return"); ------------------ | | 40| 0|# define PNGZ_MSG_CAST(s) (s) ------------------ 1064| 0| break; 1065| 8.32k| } 1066| 13.6k|} OSS_FUZZ_png_icc_check_length: 1596| 6.79k|{ 1597| 6.79k| if (!icc_check_length(png_ptr, name, profile_length)) ------------------ | Branch (1597:8): [True: 203, False: 6.59k] ------------------ 1598| 203| return 0; 1599| | 1600| | /* This needs to be here because the 'normal' check is in 1601| | * png_decompress_chunk, yet this happens after the attempt to 1602| | * png_malloc_base the required data. We only need this on read; on write 1603| | * the caller supplies the profile buffer so libpng doesn't allocate it. See 1604| | * the call to icc_check_length below (the write case). 1605| | */ 1606| 6.59k| if (profile_length > png_chunk_max(png_ptr)) ------------------ | | 1126| 6.59k|# define png_chunk_max(png_ptr) ((png_ptr)->user_chunk_malloc_max) ------------------ | Branch (1606:8): [True: 304, False: 6.29k] ------------------ 1607| 304| return png_icc_profile_error(png_ptr, name, profile_length, 1608| 304| "profile too long"); 1609| | 1610| 6.29k| return 1; 1611| 6.59k|} OSS_FUZZ_png_icc_check_header: 1617| 6.29k|{ 1618| 6.29k| png_uint_32 temp; 1619| | 1620| | /* Length check; this cannot be ignored in this code because profile_length 1621| | * is used later to check the tag table, so even if the profile seems over 1622| | * long profile_length from the caller must be correct. The caller can fix 1623| | * this up on read or write by just passing in the profile header length. 1624| | */ 1625| 6.29k| temp = png_get_uint_32(profile); ------------------ | | 322| 6.29k|#define png_get_uint_32 OSS_FUZZ_png_get_uint_32 | | ------------------ | | | | 462| 6.29k|#define OSS_FUZZ_png_get_uint_32(buf) PNG_get_uint_32(buf) | | | | ------------------ | | | | | | 2823| 6.29k| (((png_uint_32)(*(buf)) << 24) + \ | | | | | | 2824| 6.29k| ((png_uint_32)(*((buf) + 1)) << 16) + \ | | | | | | 2825| 6.29k| ((png_uint_32)(*((buf) + 2)) << 8) + \ | | | | | | 2826| 6.29k| ((png_uint_32)(*((buf) + 3)))) | | | | ------------------ | | ------------------ ------------------ 1626| 6.29k| if (temp != profile_length) ------------------ | Branch (1626:8): [True: 0, False: 6.29k] ------------------ 1627| 0| return png_icc_profile_error(png_ptr, name, temp, 1628| 0| "length does not match profile"); 1629| | 1630| 6.29k| temp = (png_uint_32) (*(profile+8)); 1631| 6.29k| if (temp > 3 && (profile_length & 3)) ------------------ | Branch (1631:8): [True: 2.68k, False: 3.60k] | Branch (1631:20): [True: 213, False: 2.47k] ------------------ 1632| 213| return png_icc_profile_error(png_ptr, name, profile_length, 1633| 213| "invalid length"); 1634| | 1635| 6.07k| temp = png_get_uint_32(profile+128); /* tag count: 12 bytes/tag */ ------------------ | | 322| 6.07k|#define png_get_uint_32 OSS_FUZZ_png_get_uint_32 | | ------------------ | | | | 462| 6.07k|#define OSS_FUZZ_png_get_uint_32(buf) PNG_get_uint_32(buf) | | | | ------------------ | | | | | | 2823| 6.07k| (((png_uint_32)(*(buf)) << 24) + \ | | | | | | 2824| 6.07k| ((png_uint_32)(*((buf) + 1)) << 16) + \ | | | | | | 2825| 6.07k| ((png_uint_32)(*((buf) + 2)) << 8) + \ | | | | | | 2826| 6.07k| ((png_uint_32)(*((buf) + 3)))) | | | | ------------------ | | ------------------ ------------------ 1636| 6.07k| if (temp > 357913930 || /* (2^32-4-132)/12: maximum possible tag count */ ------------------ | Branch (1636:8): [True: 880, False: 5.19k] ------------------ 1637| 5.19k| profile_length < 132+12*temp) /* truncated tag table */ ------------------ | Branch (1637:7): [True: 243, False: 4.95k] ------------------ 1638| 1.12k| return png_icc_profile_error(png_ptr, name, temp, 1639| 1.12k| "tag count too large"); 1640| | 1641| | /* The 'intent' must be valid or we can't store it, ICC limits the intent to 1642| | * 16 bits. 1643| | */ 1644| 4.95k| temp = png_get_uint_32(profile+64); ------------------ | | 322| 4.95k|#define png_get_uint_32 OSS_FUZZ_png_get_uint_32 | | ------------------ | | | | 462| 4.95k|#define OSS_FUZZ_png_get_uint_32(buf) PNG_get_uint_32(buf) | | | | ------------------ | | | | | | 2823| 4.95k| (((png_uint_32)(*(buf)) << 24) + \ | | | | | | 2824| 4.95k| ((png_uint_32)(*((buf) + 1)) << 16) + \ | | | | | | 2825| 4.95k| ((png_uint_32)(*((buf) + 2)) << 8) + \ | | | | | | 2826| 4.95k| ((png_uint_32)(*((buf) + 3)))) | | | | ------------------ | | ------------------ ------------------ 1645| 4.95k| if (temp >= 0xffff) /* The ICC limit */ ------------------ | Branch (1645:8): [True: 220, False: 4.73k] ------------------ 1646| 220| return png_icc_profile_error(png_ptr, name, temp, 1647| 220| "invalid rendering intent"); 1648| | 1649| | /* This is just a warning because the profile may be valid in future 1650| | * versions. 1651| | */ 1652| 4.73k| if (temp >= PNG_sRGB_INTENT_LAST) ------------------ | | 717| 4.73k|#define PNG_sRGB_INTENT_LAST 4 /* Not a valid value */ ------------------ | Branch (1652:8): [True: 3.22k, False: 1.51k] ------------------ 1653| 3.22k| (void)png_icc_profile_error(png_ptr, name, temp, 1654| 3.22k| "intent outside defined range"); 1655| | 1656| | /* At this point the tag table can't be checked because it hasn't necessarily 1657| | * been loaded; however, various header fields can be checked. These checks 1658| | * are for values permitted by the PNG spec in an ICC profile; the PNG spec 1659| | * restricts the profiles that can be passed in an iCCP chunk (they must be 1660| | * appropriate to processing PNG data!) 1661| | */ 1662| | 1663| | /* Data checks (could be skipped). These checks must be independent of the 1664| | * version number; however, the version number doesn't accommodate changes in 1665| | * the header fields (just the known tags and the interpretation of the 1666| | * data.) 1667| | */ 1668| 4.73k| temp = png_get_uint_32(profile+36); /* signature 'ascp' */ ------------------ | | 322| 4.73k|#define png_get_uint_32 OSS_FUZZ_png_get_uint_32 | | ------------------ | | | | 462| 4.73k|#define OSS_FUZZ_png_get_uint_32(buf) PNG_get_uint_32(buf) | | | | ------------------ | | | | | | 2823| 4.73k| (((png_uint_32)(*(buf)) << 24) + \ | | | | | | 2824| 4.73k| ((png_uint_32)(*((buf) + 1)) << 16) + \ | | | | | | 2825| 4.73k| ((png_uint_32)(*((buf) + 2)) << 8) + \ | | | | | | 2826| 4.73k| ((png_uint_32)(*((buf) + 3)))) | | | | ------------------ | | ------------------ ------------------ 1669| 4.73k| if (temp != 0x61637370) ------------------ | Branch (1669:8): [True: 424, False: 4.31k] ------------------ 1670| 424| return png_icc_profile_error(png_ptr, name, temp, 1671| 424| "invalid signature"); 1672| | 1673| | /* Currently the PCS illuminant/adopted white point (the computational 1674| | * white point) are required to be D50, 1675| | * however the profile contains a record of the illuminant so perhaps ICC 1676| | * expects to be able to change this in the future (despite the rationale in 1677| | * the introduction for using a fixed PCS adopted white.) Consequently the 1678| | * following is just a warning. 1679| | */ 1680| 4.31k| if (memcmp(profile+68, D50_nCIEXYZ, 12) != 0) ------------------ | Branch (1680:8): [True: 4.31k, False: 0] ------------------ 1681| 4.31k| (void)png_icc_profile_error(png_ptr, name, 0/*no tag value*/, 1682| 4.31k| "PCS illuminant is not D50"); 1683| | 1684| | /* The PNG spec requires this: 1685| | * "If the iCCP chunk is present, the image samples conform to the colour 1686| | * space represented by the embedded ICC profile as defined by the 1687| | * International Color Consortium [ICC]. The colour space of the ICC profile 1688| | * shall be an RGB colour space for colour images (PNG colour types 2, 3, and 1689| | * 6), or a greyscale colour space for greyscale images (PNG colour types 0 1690| | * and 4)." 1691| | * 1692| | * This checking code ensures the embedded profile (on either read or write) 1693| | * conforms to the specification requirements. Notice that an ICC 'gray' 1694| | * color-space profile contains the information to transform the monochrome 1695| | * data to XYZ or L*a*b (according to which PCS the profile uses) and this 1696| | * should be used in preference to the standard libpng K channel replication 1697| | * into R, G and B channels. 1698| | * 1699| | * Previously it was suggested that an RGB profile on grayscale data could be 1700| | * handled. However it is clear that using an RGB profile in this context 1701| | * must be an error - there is no specification of what it means. Thus it is 1702| | * almost certainly more correct to ignore the profile. 1703| | */ 1704| 4.31k| temp = png_get_uint_32(profile+16); /* data colour space field */ ------------------ | | 322| 4.31k|#define png_get_uint_32 OSS_FUZZ_png_get_uint_32 | | ------------------ | | | | 462| 4.31k|#define OSS_FUZZ_png_get_uint_32(buf) PNG_get_uint_32(buf) | | | | ------------------ | | | | | | 2823| 4.31k| (((png_uint_32)(*(buf)) << 24) + \ | | | | | | 2824| 4.31k| ((png_uint_32)(*((buf) + 1)) << 16) + \ | | | | | | 2825| 4.31k| ((png_uint_32)(*((buf) + 2)) << 8) + \ | | | | | | 2826| 4.31k| ((png_uint_32)(*((buf) + 3)))) | | | | ------------------ | | ------------------ ------------------ 1705| 4.31k| switch (temp) 1706| 4.31k| { 1707| 3.50k| case 0x52474220: /* 'RGB ' */ ------------------ | Branch (1707:7): [True: 3.50k, False: 811] ------------------ 1708| 3.50k| if ((color_type & PNG_COLOR_MASK_COLOR) == 0) ------------------ | | 662| 3.50k|#define PNG_COLOR_MASK_COLOR 2 ------------------ | Branch (1708:14): [True: 312, False: 3.18k] ------------------ 1709| 312| return png_icc_profile_error(png_ptr, name, temp, 1710| 312| "RGB color space not permitted on grayscale PNG"); 1711| 3.18k| break; 1712| | 1713| 3.18k| case 0x47524159: /* 'GRAY' */ ------------------ | Branch (1713:7): [True: 392, False: 3.91k] ------------------ 1714| 392| if ((color_type & PNG_COLOR_MASK_COLOR) != 0) ------------------ | | 662| 392|#define PNG_COLOR_MASK_COLOR 2 ------------------ | Branch (1714:14): [True: 195, False: 197] ------------------ 1715| 195| return png_icc_profile_error(png_ptr, name, temp, 1716| 195| "Gray color space not permitted on RGB PNG"); 1717| 197| break; 1718| | 1719| 419| default: ------------------ | Branch (1719:7): [True: 419, False: 3.89k] ------------------ 1720| 419| return png_icc_profile_error(png_ptr, name, temp, 1721| 419| "invalid ICC profile color space"); 1722| 4.31k| } 1723| | 1724| | /* It is up to the application to check that the profile class matches the 1725| | * application requirements; the spec provides no guidance, but it's pretty 1726| | * weird if the profile is not scanner ('scnr'), monitor ('mntr'), printer 1727| | * ('prtr') or 'spac' (for generic color spaces). Issue a warning in these 1728| | * cases. Issue an error for device link or abstract profiles - these don't 1729| | * contain the records necessary to transform the color-space to anything 1730| | * other than the target device (and not even that for an abstract profile). 1731| | * Profiles of these classes may not be embedded in images. 1732| | */ 1733| 3.38k| temp = png_get_uint_32(profile+12); /* profile/device class */ ------------------ | | 322| 3.38k|#define png_get_uint_32 OSS_FUZZ_png_get_uint_32 | | ------------------ | | | | 462| 3.38k|#define OSS_FUZZ_png_get_uint_32(buf) PNG_get_uint_32(buf) | | | | ------------------ | | | | | | 2823| 3.38k| (((png_uint_32)(*(buf)) << 24) + \ | | | | | | 2824| 3.38k| ((png_uint_32)(*((buf) + 1)) << 16) + \ | | | | | | 2825| 3.38k| ((png_uint_32)(*((buf) + 2)) << 8) + \ | | | | | | 2826| 3.38k| ((png_uint_32)(*((buf) + 3)))) | | | | ------------------ | | ------------------ ------------------ 1734| 3.38k| switch (temp) 1735| 3.38k| { 1736| 1| case 0x73636e72: /* 'scnr' */ ------------------ | Branch (1736:7): [True: 1, False: 3.38k] ------------------ 1737| 820| case 0x6d6e7472: /* 'mntr' */ ------------------ | Branch (1737:7): [True: 819, False: 2.56k] ------------------ 1738| 841| case 0x70727472: /* 'prtr' */ ------------------ | Branch (1738:7): [True: 21, False: 3.36k] ------------------ 1739| 1.03k| case 0x73706163: /* 'spac' */ ------------------ | Branch (1739:7): [True: 195, False: 3.19k] ------------------ 1740| | /* All supported */ 1741| 1.03k| break; 1742| | 1743| 10| case 0x61627374: /* 'abst' */ ------------------ | Branch (1743:7): [True: 10, False: 3.37k] ------------------ 1744| | /* May not be embedded in an image */ 1745| 10| return png_icc_profile_error(png_ptr, name, temp, 1746| 10| "invalid embedded Abstract ICC profile"); 1747| | 1748| 1| case 0x6c696e6b: /* 'link' */ ------------------ | Branch (1748:7): [True: 1, False: 3.38k] ------------------ 1749| | /* DeviceLink profiles cannot be interpreted in a non-device specific 1750| | * fashion, if an app uses the AToB0Tag in the profile the results are 1751| | * undefined unless the result is sent to the intended device, 1752| | * therefore a DeviceLink profile should not be found embedded in a 1753| | * PNG. 1754| | */ 1755| 1| return png_icc_profile_error(png_ptr, name, temp, 1756| 1| "unexpected DeviceLink ICC profile class"); 1757| | 1758| 1| case 0x6e6d636c: /* 'nmcl' */ ------------------ | Branch (1758:7): [True: 1, False: 3.38k] ------------------ 1759| | /* A NamedColor profile is also device specific, however it doesn't 1760| | * contain an AToB0 tag that is open to misinterpretation. Almost 1761| | * certainly it will fail the tests below. 1762| | */ 1763| 1| (void)png_icc_profile_error(png_ptr, name, temp, 1764| 1| "unexpected NamedColor ICC profile class"); 1765| 1| break; 1766| | 1767| 2.33k| default: ------------------ | Branch (1767:7): [True: 2.33k, False: 1.04k] ------------------ 1768| | /* To allow for future enhancements to the profile accept unrecognized 1769| | * profile classes with a warning, these then hit the test below on the 1770| | * tag content to ensure they are backward compatible with one of the 1771| | * understood profiles. 1772| | */ 1773| 2.33k| (void)png_icc_profile_error(png_ptr, name, temp, 1774| 2.33k| "unrecognized ICC profile class"); 1775| 2.33k| break; 1776| 3.38k| } 1777| | 1778| | /* For any profile other than a device link one the PCS must be encoded 1779| | * either in XYZ or Lab. 1780| | */ 1781| 3.37k| temp = png_get_uint_32(profile+20); ------------------ | | 322| 3.37k|#define png_get_uint_32 OSS_FUZZ_png_get_uint_32 | | ------------------ | | | | 462| 3.37k|#define OSS_FUZZ_png_get_uint_32(buf) PNG_get_uint_32(buf) | | | | ------------------ | | | | | | 2823| 3.37k| (((png_uint_32)(*(buf)) << 24) + \ | | | | | | 2824| 3.37k| ((png_uint_32)(*((buf) + 1)) << 16) + \ | | | | | | 2825| 3.37k| ((png_uint_32)(*((buf) + 2)) << 8) + \ | | | | | | 2826| 3.37k| ((png_uint_32)(*((buf) + 3)))) | | | | ------------------ | | ------------------ ------------------ 1782| 3.37k| switch (temp) 1783| 3.37k| { 1784| 2.41k| case 0x58595a20: /* 'XYZ ' */ ------------------ | Branch (1784:7): [True: 2.41k, False: 955] ------------------ 1785| 2.42k| case 0x4c616220: /* 'Lab ' */ ------------------ | Branch (1785:7): [True: 1, False: 3.37k] ------------------ 1786| 2.42k| break; 1787| | 1788| 954| default: ------------------ | Branch (1788:7): [True: 954, False: 2.42k] ------------------ 1789| 954| return png_icc_profile_error(png_ptr, name, temp, 1790| 954| "unexpected ICC PCS encoding"); 1791| 3.37k| } 1792| | 1793| 2.42k| return 1; 1794| 3.37k|} OSS_FUZZ_png_icc_check_tag_table: 1800| 1.95k|{ 1801| 1.95k| png_uint_32 tag_count = png_get_uint_32(profile+128); ------------------ | | 322| 1.95k|#define png_get_uint_32 OSS_FUZZ_png_get_uint_32 | | ------------------ | | | | 462| 1.95k|#define OSS_FUZZ_png_get_uint_32(buf) PNG_get_uint_32(buf) | | | | ------------------ | | | | | | 2823| 1.95k| (((png_uint_32)(*(buf)) << 24) + \ | | | | | | 2824| 1.95k| ((png_uint_32)(*((buf) + 1)) << 16) + \ | | | | | | 2825| 1.95k| ((png_uint_32)(*((buf) + 2)) << 8) + \ | | | | | | 2826| 1.95k| ((png_uint_32)(*((buf) + 3)))) | | | | ------------------ | | ------------------ ------------------ 1802| 1.95k| png_uint_32 itag; 1803| 1.95k| png_const_bytep tag = profile+132; /* The first tag */ 1804| | 1805| | /* First scan all the tags in the table and add bits to the icc_info value 1806| | * (temporarily in 'tags'). 1807| | */ 1808| 17.3k| for (itag=0; itag < tag_count; ++itag, tag += 12) ------------------ | Branch (1808:17): [True: 15.6k, False: 1.64k] ------------------ 1809| 15.6k| { 1810| 15.6k| png_uint_32 tag_id = png_get_uint_32(tag+0); ------------------ | | 322| 15.6k|#define png_get_uint_32 OSS_FUZZ_png_get_uint_32 | | ------------------ | | | | 462| 15.6k|#define OSS_FUZZ_png_get_uint_32(buf) PNG_get_uint_32(buf) | | | | ------------------ | | | | | | 2823| 15.6k| (((png_uint_32)(*(buf)) << 24) + \ | | | | | | 2824| 15.6k| ((png_uint_32)(*((buf) + 1)) << 16) + \ | | | | | | 2825| 15.6k| ((png_uint_32)(*((buf) + 2)) << 8) + \ | | | | | | 2826| 15.6k| ((png_uint_32)(*((buf) + 3)))) | | | | ------------------ | | ------------------ ------------------ 1811| 15.6k| png_uint_32 tag_start = png_get_uint_32(tag+4); /* must be aligned */ ------------------ | | 322| 15.6k|#define png_get_uint_32 OSS_FUZZ_png_get_uint_32 | | ------------------ | | | | 462| 15.6k|#define OSS_FUZZ_png_get_uint_32(buf) PNG_get_uint_32(buf) | | | | ------------------ | | | | | | 2823| 15.6k| (((png_uint_32)(*(buf)) << 24) + \ | | | | | | 2824| 15.6k| ((png_uint_32)(*((buf) + 1)) << 16) + \ | | | | | | 2825| 15.6k| ((png_uint_32)(*((buf) + 2)) << 8) + \ | | | | | | 2826| 15.6k| ((png_uint_32)(*((buf) + 3)))) | | | | ------------------ | | ------------------ ------------------ 1812| 15.6k| png_uint_32 tag_length = png_get_uint_32(tag+8);/* not padded */ ------------------ | | 322| 15.6k|#define png_get_uint_32 OSS_FUZZ_png_get_uint_32 | | ------------------ | | | | 462| 15.6k|#define OSS_FUZZ_png_get_uint_32(buf) PNG_get_uint_32(buf) | | | | ------------------ | | | | | | 2823| 15.6k| (((png_uint_32)(*(buf)) << 24) + \ | | | | | | 2824| 15.6k| ((png_uint_32)(*((buf) + 1)) << 16) + \ | | | | | | 2825| 15.6k| ((png_uint_32)(*((buf) + 2)) << 8) + \ | | | | | | 2826| 15.6k| ((png_uint_32)(*((buf) + 3)))) | | | | ------------------ | | ------------------ ------------------ 1813| | 1814| | /* The ICC specification does not exclude zero length tags, therefore the 1815| | * start might actually be anywhere if there is no data, but this would be 1816| | * a clear abuse of the intent of the standard so the start is checked for 1817| | * being in range. All defined tag types have an 8 byte header - a 4 byte 1818| | * type signature then 0. 1819| | */ 1820| | 1821| | /* This is a hard error; potentially it can cause read outside the 1822| | * profile. 1823| | */ 1824| 15.6k| if (tag_start > profile_length || tag_length > profile_length - tag_start) ------------------ | Branch (1824:11): [True: 145, False: 15.5k] | Branch (1824:41): [True: 167, False: 15.3k] ------------------ 1825| 312| return png_icc_profile_error(png_ptr, name, tag_id, 1826| 312| "ICC profile tag outside profile"); 1827| | 1828| 15.3k| if ((tag_start & 3) != 0) ------------------ | Branch (1828:11): [True: 9.59k, False: 5.76k] ------------------ 1829| 9.59k| { 1830| | /* CNHP730S.icc shipped with Microsoft Windows 64 violates this; it is 1831| | * only a warning here because libpng does not care about the 1832| | * alignment. 1833| | */ 1834| 9.59k| (void)png_icc_profile_error(png_ptr, name, tag_id, 1835| 9.59k| "ICC profile tag start not a multiple of 4"); 1836| 9.59k| } 1837| 15.3k| } 1838| | 1839| 1.64k| return 1; /* success, maybe with warnings */ 1840| 1.95k|} OSS_FUZZ_png_check_IHDR: 1965| 5.28k|{ 1966| 5.28k| int error = 0; 1967| | 1968| | /* Check for width and height valid values */ 1969| 5.28k| if (width == 0) ------------------ | Branch (1969:8): [True: 5, False: 5.27k] ------------------ 1970| 5| { 1971| 5| png_warning(png_ptr, "Image width is zero in IHDR"); ------------------ | | 450| 5|#define png_warning OSS_FUZZ_png_warning ------------------ 1972| 5| error = 1; 1973| 5| } 1974| | 1975| 5.28k| if (width > PNG_UINT_31_MAX) ------------------ | | 647| 5.28k|#define PNG_UINT_31_MAX ((png_uint_32)0x7fffffffL) ------------------ | Branch (1975:8): [True: 0, False: 5.28k] ------------------ 1976| 0| { 1977| 0| png_warning(png_ptr, "Invalid image width in IHDR"); ------------------ | | 450| 0|#define png_warning OSS_FUZZ_png_warning ------------------ 1978| 0| error = 1; 1979| 0| } 1980| | 1981| | /* The bit mask on the first line below must be at least as big as a 1982| | * png_uint_32. "~7U" is not adequate on 16-bit systems because it will 1983| | * be an unsigned 16-bit value. Casting to (png_alloc_size_t) makes the 1984| | * type of the result at least as bit (in bits) as the RHS of the > operator 1985| | * which also avoids a common warning on 64-bit systems that the comparison 1986| | * of (png_uint_32) against the constant value on the RHS will always be 1987| | * false. 1988| | */ 1989| 5.28k| if (((width + 7) & ~(png_alloc_size_t)7) > ------------------ | Branch (1989:8): [True: 0, False: 5.28k] ------------------ 1990| 5.28k| (((PNG_SIZE_MAX ------------------ | | 649| 5.28k|#define PNG_SIZE_MAX ((size_t)(-1)) ------------------ 1991| 5.28k| - 48 /* big_row_buf hack */ 1992| 5.28k| - 1) /* filter byte */ 1993| 5.28k| / 8) /* 8-byte RGBA pixels */ 1994| 5.28k| - 1)) /* extra max_pixel_depth pad */ 1995| 0| { 1996| | /* The size of the row must be within the limits of this architecture. 1997| | * Because the read code can perform arbitrary transformations the 1998| | * maximum size is checked here. Because the code in png_read_start_row 1999| | * adds extra space "for safety's sake" in several places a conservative 2000| | * limit is used here. 2001| | * 2002| | * NOTE: it would be far better to check the size that is actually used, 2003| | * but the effect in the real world is minor and the changes are more 2004| | * extensive, therefore much more dangerous and much more difficult to 2005| | * write in a way that avoids compiler warnings. 2006| | */ 2007| 0| png_warning(png_ptr, "Image width is too large for this architecture"); ------------------ | | 450| 0|#define png_warning OSS_FUZZ_png_warning ------------------ 2008| 0| error = 1; 2009| 0| } 2010| | 2011| 5.28k|#ifdef PNG_SET_USER_LIMITS_SUPPORTED 2012| 5.28k| if (width > png_ptr->user_width_max) ------------------ | Branch (2012:8): [True: 35, False: 5.24k] ------------------ 2013| |#else 2014| | if (width > PNG_USER_WIDTH_MAX) 2015| |#endif 2016| 35| { 2017| 35| png_warning(png_ptr, "Image width exceeds user limit in IHDR"); ------------------ | | 450| 35|#define png_warning OSS_FUZZ_png_warning ------------------ 2018| 35| error = 1; 2019| 35| } 2020| | 2021| 5.28k| if (height == 0) ------------------ | Branch (2021:8): [True: 6, False: 5.27k] ------------------ 2022| 6| { 2023| 6| png_warning(png_ptr, "Image height is zero in IHDR"); ------------------ | | 450| 6|#define png_warning OSS_FUZZ_png_warning ------------------ 2024| 6| error = 1; 2025| 6| } 2026| | 2027| 5.28k| if (height > PNG_UINT_31_MAX) ------------------ | | 647| 5.28k|#define PNG_UINT_31_MAX ((png_uint_32)0x7fffffffL) ------------------ | Branch (2027:8): [True: 0, False: 5.28k] ------------------ 2028| 0| { 2029| 0| png_warning(png_ptr, "Invalid image height in IHDR"); ------------------ | | 450| 0|#define png_warning OSS_FUZZ_png_warning ------------------ 2030| 0| error = 1; 2031| 0| } 2032| | 2033| 5.28k|#ifdef PNG_SET_USER_LIMITS_SUPPORTED 2034| 5.28k| if (height > png_ptr->user_height_max) ------------------ | Branch (2034:8): [True: 52, False: 5.23k] ------------------ 2035| |#else 2036| | if (height > PNG_USER_HEIGHT_MAX) 2037| |#endif 2038| 52| { 2039| 52| png_warning(png_ptr, "Image height exceeds user limit in IHDR"); ------------------ | | 450| 52|#define png_warning OSS_FUZZ_png_warning ------------------ 2040| 52| error = 1; 2041| 52| } 2042| | 2043| | /* Check other values */ 2044| 5.28k| if (bit_depth != 1 && bit_depth != 2 && bit_depth != 4 && ------------------ | Branch (2044:8): [True: 4.13k, False: 1.15k] | Branch (2044:26): [True: 3.67k, False: 454] | Branch (2044:44): [True: 3.50k, False: 175] ------------------ 2045| 3.50k| bit_depth != 8 && bit_depth != 16) ------------------ | Branch (2045:8): [True: 1.55k, False: 1.95k] | Branch (2045:26): [True: 68, False: 1.48k] ------------------ 2046| 68| { 2047| 68| png_warning(png_ptr, "Invalid bit depth in IHDR"); ------------------ | | 450| 68|#define png_warning OSS_FUZZ_png_warning ------------------ 2048| 68| error = 1; 2049| 68| } 2050| | 2051| 5.28k| if (color_type < 0 || color_type == 1 || ------------------ | Branch (2051:8): [True: 0, False: 5.28k] | Branch (2051:26): [True: 6, False: 5.27k] ------------------ 2052| 5.27k| color_type == 5 || color_type > 6) ------------------ | Branch (2052:8): [True: 1, False: 5.27k] | Branch (2052:27): [True: 38, False: 5.23k] ------------------ 2053| 45| { 2054| 45| png_warning(png_ptr, "Invalid color type in IHDR"); ------------------ | | 450| 45|#define png_warning OSS_FUZZ_png_warning ------------------ 2055| 45| error = 1; 2056| 45| } 2057| | 2058| 5.28k| if (((color_type == PNG_COLOR_TYPE_PALETTE) && bit_depth > 8) || ------------------ | | 667| 5.28k|#define PNG_COLOR_TYPE_PALETTE (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_PALETTE) | | ------------------ | | | | 662| 5.28k|#define PNG_COLOR_MASK_COLOR 2 | | ------------------ | | #define PNG_COLOR_TYPE_PALETTE (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_PALETTE) | | ------------------ | | | | 661| 5.28k|#define PNG_COLOR_MASK_PALETTE 1 | | ------------------ ------------------ | Branch (2058:9): [True: 1.06k, False: 4.21k] | Branch (2058:51): [True: 4, False: 1.06k] ------------------ 2059| 5.28k| ((color_type == PNG_COLOR_TYPE_RGB || ------------------ | | 668| 10.5k|#define PNG_COLOR_TYPE_RGB (PNG_COLOR_MASK_COLOR) | | ------------------ | | | | 662| 5.28k|#define PNG_COLOR_MASK_COLOR 2 | | ------------------ ------------------ | Branch (2059:10): [True: 1.32k, False: 3.95k] ------------------ 2060| 3.95k| color_type == PNG_COLOR_TYPE_GRAY_ALPHA || ------------------ | | 670| 9.23k|#define PNG_COLOR_TYPE_GRAY_ALPHA (PNG_COLOR_MASK_ALPHA) | | ------------------ | | | | 663| 3.95k|#define PNG_COLOR_MASK_ALPHA 4 | | ------------------ ------------------ | Branch (2060:10): [True: 207, False: 3.74k] ------------------ 2061| 3.74k| color_type == PNG_COLOR_TYPE_RGB_ALPHA) && bit_depth < 8)) ------------------ | | 669| 3.74k|#define PNG_COLOR_TYPE_RGB_ALPHA (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_ALPHA) | | ------------------ | | | | 662| 3.74k|#define PNG_COLOR_MASK_COLOR 2 | | ------------------ | | #define PNG_COLOR_TYPE_RGB_ALPHA (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_ALPHA) | | ------------------ | | | | 663| 3.74k|#define PNG_COLOR_MASK_ALPHA 4 | | ------------------ ------------------ | Branch (2061:10): [True: 833, False: 2.91k] | Branch (2061:53): [True: 4, False: 2.36k] ------------------ 2062| 8| { 2063| 8| png_warning(png_ptr, "Invalid color type/bit depth combination in IHDR"); ------------------ | | 450| 8|#define png_warning OSS_FUZZ_png_warning ------------------ 2064| 8| error = 1; 2065| 8| } 2066| | 2067| 5.28k| if (interlace_type >= PNG_INTERLACE_LAST) ------------------ | | 687| 5.28k|#define PNG_INTERLACE_LAST 2 /* Not a valid value */ ------------------ | Branch (2067:8): [True: 36, False: 5.24k] ------------------ 2068| 36| { 2069| 36| png_warning(png_ptr, "Unknown interlace method in IHDR"); ------------------ | | 450| 36|#define png_warning OSS_FUZZ_png_warning ------------------ 2070| 36| error = 1; 2071| 36| } 2072| | 2073| 5.28k| if (compression_type != PNG_COMPRESSION_TYPE_BASE) ------------------ | | 676| 5.28k|#define PNG_COMPRESSION_TYPE_BASE 0 /* Deflate method 8, 32K window */ ------------------ | Branch (2073:8): [True: 40, False: 5.24k] ------------------ 2074| 40| { 2075| 40| png_warning(png_ptr, "Unknown compression method in IHDR"); ------------------ | | 450| 40|#define png_warning OSS_FUZZ_png_warning ------------------ 2076| 40| error = 1; 2077| 40| } 2078| | 2079| 5.28k|#ifdef PNG_MNG_FEATURES_SUPPORTED 2080| | /* Accept filter_method 64 (intrapixel differencing) only if 2081| | * 1. Libpng was compiled with PNG_MNG_FEATURES_SUPPORTED and 2082| | * 2. Libpng did not read a PNG signature (this filter_method is only 2083| | * used in PNG datastreams that are embedded in MNG datastreams) and 2084| | * 3. The application called png_permit_mng_features with a mask that 2085| | * included PNG_FLAG_MNG_FILTER_64 and 2086| | * 4. The filter_method is 64 and 2087| | * 5. The color_type is RGB or RGBA 2088| | */ 2089| 5.28k| if ((png_ptr->mode & PNG_HAVE_PNG_SIGNATURE) != 0 && ------------------ | | 652| 5.28k|#define PNG_HAVE_PNG_SIGNATURE 0x1000U ------------------ | Branch (2089:8): [True: 5.28k, False: 0] ------------------ 2090| 5.28k| png_ptr->mng_features_permitted != 0) ------------------ | Branch (2090:8): [True: 0, False: 5.28k] ------------------ 2091| 0| png_warning(png_ptr, "MNG features are not allowed in a PNG datastream"); ------------------ | | 450| 0|#define png_warning OSS_FUZZ_png_warning ------------------ 2092| | 2093| 5.28k| if (filter_type != PNG_FILTER_TYPE_BASE) ------------------ | | 680| 5.28k|#define PNG_FILTER_TYPE_BASE 0 /* Single row per-byte filtering */ ------------------ | Branch (2093:8): [True: 44, False: 5.24k] ------------------ 2094| 44| { 2095| 44| if (!((png_ptr->mng_features_permitted & PNG_FLAG_MNG_FILTER_64) != 0 && ------------------ | | 876| 44|#define PNG_FLAG_MNG_FILTER_64 0x04 ------------------ | Branch (2095:13): [True: 0, False: 44] ------------------ 2096| 0| (filter_type == PNG_INTRAPIXEL_DIFFERENCING) && ------------------ | | 681| 0|#define PNG_INTRAPIXEL_DIFFERENCING 64 /* Used only in MNG datastreams */ ------------------ | Branch (2096:11): [True: 0, False: 0] ------------------ 2097| 0| ((png_ptr->mode & PNG_HAVE_PNG_SIGNATURE) == 0) && ------------------ | | 652| 0|#define PNG_HAVE_PNG_SIGNATURE 0x1000U ------------------ | Branch (2097:11): [True: 0, False: 0] ------------------ 2098| 0| (color_type == PNG_COLOR_TYPE_RGB || ------------------ | | 668| 0|#define PNG_COLOR_TYPE_RGB (PNG_COLOR_MASK_COLOR) | | ------------------ | | | | 662| 0|#define PNG_COLOR_MASK_COLOR 2 | | ------------------ ------------------ | Branch (2098:12): [True: 0, False: 0] ------------------ 2099| 0| color_type == PNG_COLOR_TYPE_RGB_ALPHA))) ------------------ | | 669| 0|#define PNG_COLOR_TYPE_RGB_ALPHA (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_ALPHA) | | ------------------ | | | | 662| 0|#define PNG_COLOR_MASK_COLOR 2 | | ------------------ | | #define PNG_COLOR_TYPE_RGB_ALPHA (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_ALPHA) | | ------------------ | | | | 663| 0|#define PNG_COLOR_MASK_ALPHA 4 | | ------------------ ------------------ | Branch (2099:11): [True: 0, False: 0] ------------------ 2100| 44| { 2101| 44| png_warning(png_ptr, "Unknown filter method in IHDR"); ------------------ | | 450| 44|#define png_warning OSS_FUZZ_png_warning ------------------ 2102| 44| error = 1; 2103| 44| } 2104| | 2105| 44| if ((png_ptr->mode & PNG_HAVE_PNG_SIGNATURE) != 0) ------------------ | | 652| 44|#define PNG_HAVE_PNG_SIGNATURE 0x1000U ------------------ | Branch (2105:11): [True: 44, False: 0] ------------------ 2106| 44| { 2107| 44| png_warning(png_ptr, "Invalid filter method in IHDR"); ------------------ | | 450| 44|#define png_warning OSS_FUZZ_png_warning ------------------ 2108| 44| error = 1; 2109| 44| } 2110| 44| } 2111| | 2112| |#else 2113| | if (filter_type != PNG_FILTER_TYPE_BASE) 2114| | { 2115| | png_warning(png_ptr, "Unknown filter method in IHDR"); 2116| | error = 1; 2117| | } 2118| |#endif 2119| | 2120| 5.28k| if (error == 1) ------------------ | Branch (2120:8): [True: 91, False: 5.19k] ------------------ 2121| 91| png_error(png_ptr, "Invalid IHDR data"); ------------------ | | 252| 91|#define png_error OSS_FUZZ_png_error ------------------ 2122| 5.28k|} OSS_FUZZ_png_check_fp_number: 2136| 2.80k|{ 2137| 2.80k| int state = *statep; 2138| 2.80k| size_t i = *whereami; 2139| | 2140| 17.2k| while (i < size) ------------------ | Branch (2140:11): [True: 16.9k, False: 310] ------------------ 2141| 16.9k| { 2142| 16.9k| int type; 2143| | /* First find the type of the next character */ 2144| 16.9k| switch (string[i]) 2145| 16.9k| { 2146| 67| case 43: type = PNG_FP_SAW_SIGN; break; ------------------ | | 2118| 67|#define PNG_FP_SAW_SIGN 4 /* Saw +/- in current state */ ------------------ | Branch (2146:7): [True: 67, False: 16.9k] ------------------ 2147| 1.44k| case 45: type = PNG_FP_SAW_SIGN + PNG_FP_NEGATIVE; break; ------------------ | | 2118| 1.44k|#define PNG_FP_SAW_SIGN 4 /* Saw +/- in current state */ ------------------ case 45: type = PNG_FP_SAW_SIGN + PNG_FP_NEGATIVE; break; ------------------ | | 2127| 1.44k|#define PNG_FP_NEGATIVE 128 /* A negative number, including "-0" */ ------------------ | Branch (2147:7): [True: 1.44k, False: 15.5k] ------------------ 2148| 213| case 46: type = PNG_FP_SAW_DOT; break; ------------------ | | 2120| 213|#define PNG_FP_SAW_DOT 16 /* Saw a dot in current state */ ------------------ | Branch (2148:7): [True: 213, False: 16.7k] ------------------ 2149| 32| case 48: type = PNG_FP_SAW_DIGIT; break; ------------------ | | 2119| 32|#define PNG_FP_SAW_DIGIT 8 /* Saw a digit in current state */ ------------------ | Branch (2149:7): [True: 32, False: 16.9k] ------------------ 2150| 6.67k| case 49: case 50: case 51: case 52: ------------------ | Branch (2150:7): [True: 470, False: 16.5k] | Branch (2150:16): [True: 2.10k, False: 14.8k] | Branch (2150:25): [True: 2.14k, False: 14.8k] | Branch (2150:34): [True: 1.96k, False: 15.0k] ------------------ 2151| 10.1k| case 53: case 54: case 55: case 56: ------------------ | Branch (2151:7): [True: 223, False: 16.7k] | Branch (2151:16): [True: 1.53k, False: 15.4k] | Branch (2151:25): [True: 989, False: 15.9k] | Branch (2151:34): [True: 716, False: 16.2k] ------------------ 2152| 11.3k| case 57: type = PNG_FP_SAW_DIGIT + PNG_FP_NONZERO; break; ------------------ | | 2119| 11.3k|#define PNG_FP_SAW_DIGIT 8 /* Saw a digit in current state */ ------------------ case 57: type = PNG_FP_SAW_DIGIT + PNG_FP_NONZERO; break; ------------------ | | 2128| 11.3k|#define PNG_FP_NONZERO 256 /* A non-zero value */ ------------------ | Branch (2152:7): [True: 1.24k, False: 15.7k] ------------------ 2153| 1.79k| case 69: ------------------ | Branch (2153:7): [True: 1.79k, False: 15.1k] ------------------ 2154| 1.88k| case 101: type = PNG_FP_SAW_E; break; ------------------ | | 2121| 1.88k|#define PNG_FP_SAW_E 32 /* Saw an E (or e) in current state */ ------------------ | Branch (2154:7): [True: 85, False: 16.8k] ------------------ 2155| 1.96k| default: goto PNG_FP_End; ------------------ | Branch (2155:7): [True: 1.96k, False: 15.0k] ------------------ 2156| 16.9k| } 2157| | 2158| | /* Now deal with this type according to the current 2159| | * state, the type is arranged to not overlap the 2160| | * bits of the PNG_FP_STATE. 2161| | */ 2162| 15.0k| switch ((state & PNG_FP_STATE) + (type & PNG_FP_SAW_ANY)) ------------------ | | 2117| 15.0k|#define PNG_FP_STATE 3 /* mask for the above */ ------------------ switch ((state & PNG_FP_STATE) + (type & PNG_FP_SAW_ANY)) ------------------ | | 2122| 15.0k|#define PNG_FP_SAW_ANY 60 /* Saw any of the above 4 */ ------------------ 2163| 15.0k| { 2164| 274| case PNG_FP_INTEGER + PNG_FP_SAW_SIGN: ------------------ | | 2114| 274|#define PNG_FP_INTEGER 0 /* before or in integer */ ------------------ case PNG_FP_INTEGER + PNG_FP_SAW_SIGN: ------------------ | | 2118| 274|#define PNG_FP_SAW_SIGN 4 /* Saw +/- in current state */ ------------------ | Branch (2164:7): [True: 274, False: 14.7k] ------------------ 2165| 274| if ((state & PNG_FP_SAW_ANY) != 0) ------------------ | | 2122| 274|#define PNG_FP_SAW_ANY 60 /* Saw any of the above 4 */ ------------------ | Branch (2165:14): [True: 77, False: 197] ------------------ 2166| 77| goto PNG_FP_End; /* not a part of the number */ 2167| | 2168| 197| png_fp_add(state, type); ------------------ | | 2130| 197|#define png_fp_add(state, flags) ((state) |= (flags)) ------------------ 2169| 197| break; 2170| | 2171| 213| case PNG_FP_INTEGER + PNG_FP_SAW_DOT: ------------------ | | 2114| 213|#define PNG_FP_INTEGER 0 /* before or in integer */ ------------------ case PNG_FP_INTEGER + PNG_FP_SAW_DOT: ------------------ | | 2120| 213|#define PNG_FP_SAW_DOT 16 /* Saw a dot in current state */ ------------------ | Branch (2171:7): [True: 213, False: 14.8k] ------------------ 2172| | /* Ok as trailer, ok as lead of fraction. */ 2173| 213| if ((state & PNG_FP_SAW_DOT) != 0) /* two dots */ ------------------ | | 2120| 213|#define PNG_FP_SAW_DOT 16 /* Saw a dot in current state */ ------------------ | Branch (2173:14): [True: 1, False: 212] ------------------ 2174| 1| goto PNG_FP_End; 2175| | 2176| 212| else if ((state & PNG_FP_SAW_DIGIT) != 0) /* trailing dot? */ ------------------ | | 2119| 212|#define PNG_FP_SAW_DIGIT 8 /* Saw a digit in current state */ ------------------ | Branch (2176:19): [True: 21, False: 191] ------------------ 2177| 21| png_fp_add(state, type); ------------------ | | 2130| 21|#define png_fp_add(state, flags) ((state) |= (flags)) ------------------ 2178| | 2179| 191| else 2180| 191| png_fp_set(state, PNG_FP_FRACTION | type); ------------------ | | 2131| 191|#define png_fp_set(state, value) ((state) = (value) | ((state) & PNG_FP_STICKY)) | | ------------------ | | | | 2129| 191|#define PNG_FP_STICKY 448 /* The above three flags */ | | ------------------ ------------------ 2181| | 2182| 212| break; 2183| | 2184| 8.59k| case PNG_FP_INTEGER + PNG_FP_SAW_DIGIT: ------------------ | | 2114| 8.59k|#define PNG_FP_INTEGER 0 /* before or in integer */ ------------------ case PNG_FP_INTEGER + PNG_FP_SAW_DIGIT: ------------------ | | 2119| 8.59k|#define PNG_FP_SAW_DIGIT 8 /* Saw a digit in current state */ ------------------ | Branch (2184:7): [True: 8.59k, False: 6.42k] ------------------ 2185| 8.59k| if ((state & PNG_FP_SAW_DOT) != 0) /* delayed fraction */ ------------------ | | 2120| 8.59k|#define PNG_FP_SAW_DOT 16 /* Saw a dot in current state */ ------------------ | Branch (2185:14): [True: 20, False: 8.57k] ------------------ 2186| 20| png_fp_set(state, PNG_FP_FRACTION | PNG_FP_SAW_DOT); ------------------ | | 2131| 20|#define png_fp_set(state, value) ((state) = (value) | ((state) & PNG_FP_STICKY)) | | ------------------ | | | | 2129| 20|#define PNG_FP_STICKY 448 /* The above three flags */ | | ------------------ ------------------ 2187| | 2188| 8.59k| png_fp_add(state, type | PNG_FP_WAS_VALID); ------------------ | | 2130| 8.59k|#define png_fp_add(state, flags) ((state) |= (flags)) ------------------ 2189| | 2190| 8.59k| break; 2191| | 2192| 1.61k| case PNG_FP_INTEGER + PNG_FP_SAW_E: ------------------ | | 2114| 1.61k|#define PNG_FP_INTEGER 0 /* before or in integer */ ------------------ case PNG_FP_INTEGER + PNG_FP_SAW_E: ------------------ | | 2121| 1.61k|#define PNG_FP_SAW_E 32 /* Saw an E (or e) in current state */ ------------------ | Branch (2192:7): [True: 1.61k, False: 13.4k] ------------------ 2193| 1.61k| if ((state & PNG_FP_SAW_DIGIT) == 0) ------------------ | | 2119| 1.61k|#define PNG_FP_SAW_DIGIT 8 /* Saw a digit in current state */ ------------------ | Branch (2193:14): [True: 194, False: 1.41k] ------------------ 2194| 194| goto PNG_FP_End; 2195| | 2196| 1.41k| png_fp_set(state, PNG_FP_EXPONENT); ------------------ | | 2131| 1.41k|#define png_fp_set(state, value) ((state) = (value) | ((state) & PNG_FP_STICKY)) | | ------------------ | | | | 2129| 1.41k|#define PNG_FP_STICKY 448 /* The above three flags */ | | ------------------ ------------------ 2197| | 2198| 1.41k| break; 2199| | 2200| | /* case PNG_FP_FRACTION + PNG_FP_SAW_SIGN: 2201| | goto PNG_FP_End; ** no sign in fraction */ 2202| | 2203| | /* case PNG_FP_FRACTION + PNG_FP_SAW_DOT: 2204| | goto PNG_FP_End; ** Because SAW_DOT is always set */ 2205| | 2206| 782| case PNG_FP_FRACTION + PNG_FP_SAW_DIGIT: ------------------ | | 2115| 782|#define PNG_FP_FRACTION 1 /* before or in fraction */ ------------------ case PNG_FP_FRACTION + PNG_FP_SAW_DIGIT: ------------------ | | 2119| 782|#define PNG_FP_SAW_DIGIT 8 /* Saw a digit in current state */ ------------------ | Branch (2206:7): [True: 782, False: 14.2k] ------------------ 2207| 782| png_fp_add(state, type | PNG_FP_WAS_VALID); ------------------ | | 2130| 782|#define png_fp_add(state, flags) ((state) |= (flags)) ------------------ 2208| 782| break; 2209| | 2210| 205| case PNG_FP_FRACTION + PNG_FP_SAW_E: ------------------ | | 2115| 205|#define PNG_FP_FRACTION 1 /* before or in fraction */ ------------------ case PNG_FP_FRACTION + PNG_FP_SAW_E: ------------------ | | 2121| 205|#define PNG_FP_SAW_E 32 /* Saw an E (or e) in current state */ ------------------ | Branch (2210:7): [True: 205, False: 14.8k] ------------------ 2211| | /* This is correct because the trailing '.' on an 2212| | * integer is handled above - so we can only get here 2213| | * with the sequence ".E" (with no preceding digits). 2214| | */ 2215| 205| if ((state & PNG_FP_SAW_DIGIT) == 0) ------------------ | | 2119| 205|#define PNG_FP_SAW_DIGIT 8 /* Saw a digit in current state */ ------------------ | Branch (2215:14): [True: 1, False: 204] ------------------ 2216| 1| goto PNG_FP_End; 2217| | 2218| 204| png_fp_set(state, PNG_FP_EXPONENT); ------------------ | | 2131| 204|#define png_fp_set(state, value) ((state) = (value) | ((state) & PNG_FP_STICKY)) | | ------------------ | | | | 2129| 204|#define PNG_FP_STICKY 448 /* The above three flags */ | | ------------------ ------------------ 2219| | 2220| 204| break; 2221| | 2222| 1.23k| case PNG_FP_EXPONENT + PNG_FP_SAW_SIGN: ------------------ | | 2116| 1.23k|#define PNG_FP_EXPONENT 2 /* before or in exponent */ ------------------ case PNG_FP_EXPONENT + PNG_FP_SAW_SIGN: ------------------ | | 2118| 1.23k|#define PNG_FP_SAW_SIGN 4 /* Saw +/- in current state */ ------------------ | Branch (2222:7): [True: 1.23k, False: 13.7k] ------------------ 2223| 1.23k| if ((state & PNG_FP_SAW_ANY) != 0) ------------------ | | 2122| 1.23k|#define PNG_FP_SAW_ANY 60 /* Saw any of the above 4 */ ------------------ | Branch (2223:14): [True: 194, False: 1.04k] ------------------ 2224| 194| goto PNG_FP_End; /* not a part of the number */ 2225| | 2226| 1.04k| png_fp_add(state, PNG_FP_SAW_SIGN); ------------------ | | 2130| 1.04k|#define png_fp_add(state, flags) ((state) |= (flags)) ------------------ 2227| | 2228| 1.04k| break; 2229| | 2230| | /* case PNG_FP_EXPONENT + PNG_FP_SAW_DOT: 2231| | goto PNG_FP_End; */ 2232| | 2233| 2.03k| case PNG_FP_EXPONENT + PNG_FP_SAW_DIGIT: ------------------ | | 2116| 2.03k|#define PNG_FP_EXPONENT 2 /* before or in exponent */ ------------------ case PNG_FP_EXPONENT + PNG_FP_SAW_DIGIT: ------------------ | | 2119| 2.03k|#define PNG_FP_SAW_DIGIT 8 /* Saw a digit in current state */ ------------------ | Branch (2233:7): [True: 2.03k, False: 12.9k] ------------------ 2234| 2.03k| png_fp_add(state, PNG_FP_SAW_DIGIT | PNG_FP_WAS_VALID); ------------------ | | 2130| 2.03k|#define png_fp_add(state, flags) ((state) |= (flags)) ------------------ 2235| | 2236| 2.03k| break; 2237| | 2238| | /* case PNG_FP_EXPONEXT + PNG_FP_SAW_E: 2239| | goto PNG_FP_End; */ 2240| | 2241| 66| default: goto PNG_FP_End; /* I.e. break 2 */ ------------------ | Branch (2241:7): [True: 66, False: 14.9k] ------------------ 2242| 15.0k| } 2243| | 2244| | /* The character seems ok, continue. */ 2245| 14.4k| ++i; 2246| 14.4k| } 2247| | 2248| 2.80k|PNG_FP_End: 2249| | /* Here at the end, update the state and return the correct 2250| | * return code. 2251| | */ 2252| 2.80k| *statep = state; 2253| 2.80k| *whereami = i; 2254| | 2255| 2.80k| return (state & PNG_FP_SAW_DIGIT) != 0; ------------------ | | 2119| 2.80k|#define PNG_FP_SAW_DIGIT 8 /* Saw a digit in current state */ ------------------ 2256| 2.80k|} OSS_FUZZ_png_check_fp_string: 2262| 38|{ 2263| 38| int state = 0; 2264| 38| size_t char_index = 0; 2265| | 2266| 38| if (png_check_fp_number(string, size, &state, &char_index) != 0 && ------------------ | | 86| 38|#define png_check_fp_number OSS_FUZZ_png_check_fp_number ------------------ | Branch (2266:8): [True: 31, False: 7] ------------------ 2267| 31| (char_index == size || string[char_index] == 0)) ------------------ | Branch (2267:8): [True: 27, False: 4] | Branch (2267:30): [True: 0, False: 4] ------------------ 2268| 27| return state /* must be non-zero - see above */; 2269| | 2270| 11| return 0; /* i.e. fail */ 2271| 38|} OSS_FUZZ_png_muldiv: 2772| 1.25k|{ 2773| | /* Return a * times / divisor, rounded. */ 2774| 1.25k| if (divisor != 0) ------------------ | Branch (2774:8): [True: 1.25k, False: 0] ------------------ 2775| 1.25k| { 2776| 1.25k| if (a == 0 || times == 0) ------------------ | Branch (2776:11): [True: 0, False: 1.25k] | Branch (2776:21): [True: 0, False: 1.25k] ------------------ 2777| 0| { 2778| 0| *res = 0; 2779| 0| return 1; 2780| 0| } 2781| 1.25k| else 2782| 1.25k| { 2783| 1.25k|#ifdef PNG_FLOATING_ARITHMETIC_SUPPORTED 2784| 1.25k| double r = a; 2785| 1.25k| r *= times; 2786| 1.25k| r /= divisor; 2787| 1.25k| r = floor(r+.5); 2788| | 2789| | /* A png_fixed_point is a 32-bit integer. */ 2790| 1.25k| if (r <= 2147483647. && r >= -2147483648.) ------------------ | Branch (2790:14): [True: 1.25k, False: 0] | Branch (2790:34): [True: 1.25k, False: 0] ------------------ 2791| 1.25k| { 2792| 1.25k| *res = (png_fixed_point)r; 2793| 1.25k| return 1; 2794| 1.25k| } 2795| |#else 2796| | int negative = 0; 2797| | png_uint_32 A, T, D; 2798| | png_uint_32 s16, s32, s00; 2799| | 2800| | if (a < 0) 2801| | negative = 1, A = -a; 2802| | else 2803| | A = a; 2804| | 2805| | if (times < 0) 2806| | negative = !negative, T = -times; 2807| | else 2808| | T = times; 2809| | 2810| | if (divisor < 0) 2811| | negative = !negative, D = -divisor; 2812| | else 2813| | D = divisor; 2814| | 2815| | /* Following can't overflow because the arguments only 2816| | * have 31 bits each, however the result may be 32 bits. 2817| | */ 2818| | s16 = (A >> 16) * (T & 0xffff) + 2819| | (A & 0xffff) * (T >> 16); 2820| | /* Can't overflow because the a*times bit is only 30 2821| | * bits at most. 2822| | */ 2823| | s32 = (A >> 16) * (T >> 16) + (s16 >> 16); 2824| | s00 = (A & 0xffff) * (T & 0xffff); 2825| | 2826| | s16 = (s16 & 0xffff) << 16; 2827| | s00 += s16; 2828| | 2829| | if (s00 < s16) 2830| | ++s32; /* carry */ 2831| | 2832| | if (s32 < D) /* else overflow */ 2833| | { 2834| | /* s32.s00 is now the 64-bit product, do a standard 2835| | * division, we know that s32 < D, so the maximum 2836| | * required shift is 31. 2837| | */ 2838| | int bitshift = 32; 2839| | png_fixed_point result = 0; /* NOTE: signed */ 2840| | 2841| | while (--bitshift >= 0) 2842| | { 2843| | png_uint_32 d32, d00; 2844| | 2845| | if (bitshift > 0) 2846| | d32 = D >> (32-bitshift), d00 = D << bitshift; 2847| | 2848| | else 2849| | d32 = 0, d00 = D; 2850| | 2851| | if (s32 > d32) 2852| | { 2853| | if (s00 < d00) --s32; /* carry */ 2854| | s32 -= d32, s00 -= d00, result += 1<= d00) 2859| | s32 = 0, s00 -= d00, result += 1<= (D >> 1)) 2864| | ++result; 2865| | 2866| | if (negative != 0) 2867| | result = -result; 2868| | 2869| | /* Check for overflow. */ 2870| | if ((negative != 0 && result <= 0) || 2871| | (negative == 0 && result >= 0)) 2872| | { 2873| | *res = result; 2874| | return 1; 2875| | } 2876| | } 2877| |#endif 2878| 1.25k| } 2879| 1.25k| } 2880| | 2881| 0| return 0; 2882| 1.25k|} OSS_FUZZ_png_reciprocal: 2887| 2.72k|{ 2888| 2.72k|#ifdef PNG_FLOATING_ARITHMETIC_SUPPORTED 2889| 2.72k| double r = floor(1E10/a+.5); 2890| | 2891| 2.72k| if (r <= 2147483647. && r >= -2147483648.) ------------------ | Branch (2891:8): [True: 2.72k, False: 3] | Branch (2891:28): [True: 2.72k, False: 0] ------------------ 2892| 2.72k| return (png_fixed_point)r; 2893| |#else 2894| | png_fixed_point res; 2895| | 2896| | if (png_muldiv(&res, 100000, 100000, a) != 0) 2897| | return res; 2898| |#endif 2899| | 2900| 3| return 0; /* error/overflow */ 2901| 2.72k|} OSS_FUZZ_png_gamma_significant: 2910| 7.58k|{ 2911| | /* sRGB: 1/2.2 == 0.4545(45) 2912| | * AdobeRGB: 1/(2+51/256) ~= 0.45471 5dp 2913| | * 2914| | * So the correction from AdobeRGB to sRGB (output) is: 2915| | * 2916| | * 2.2/(2+51/256) == 1.00035524 2917| | * 2918| | * I.e. vanishingly small (<4E-4) but still detectable in 16-bit linear (+/- 2919| | * 23). Note that the Adobe choice seems to be something intended to give an 2920| | * exact number with 8 binary fractional digits - it is the closest to 2.2 2921| | * that is possible a base 2 .8p representation. 2922| | */ 2923| 7.58k| return gamma_val < PNG_FP_1 - PNG_GAMMA_THRESHOLD_FIXED || ------------------ | | 654| 7.58k|#define PNG_FP_1 100000 ------------------ return gamma_val < PNG_FP_1 - PNG_GAMMA_THRESHOLD_FIXED || ------------------ | | 208| 15.1k|#define PNG_GAMMA_THRESHOLD_FIXED 5000 ------------------ | Branch (2923:11): [True: 583, False: 7.00k] ------------------ 2924| 7.00k| gamma_val > PNG_FP_1 + PNG_GAMMA_THRESHOLD_FIXED; ------------------ | | 654| 7.00k|#define PNG_FP_1 100000 ------------------ gamma_val > PNG_FP_1 + PNG_GAMMA_THRESHOLD_FIXED; ------------------ | | 208| 7.00k|#define PNG_GAMMA_THRESHOLD_FIXED 5000 ------------------ | Branch (2924:8): [True: 2.43k, False: 4.56k] ------------------ 2925| 7.58k|} OSS_FUZZ_png_reciprocal2: 2953| 812|{ 2954| | /* The required result is 1/a * 1/b; the following preserves accuracy. */ 2955| 812|#ifdef PNG_FLOATING_ARITHMETIC_SUPPORTED 2956| 812| if (a != 0 && b != 0) ------------------ | Branch (2956:8): [True: 812, False: 0] | Branch (2956:18): [True: 812, False: 0] ------------------ 2957| 812| { 2958| 812| double r = 1E15/a; 2959| 812| r /= b; 2960| 812| r = floor(r+.5); 2961| | 2962| 812| if (r <= 2147483647. && r >= -2147483648.) ------------------ | Branch (2962:11): [True: 810, False: 2] | Branch (2962:31): [True: 810, False: 0] ------------------ 2963| 810| return (png_fixed_point)r; 2964| 812| } 2965| |#else 2966| | /* This may overflow because the range of png_fixed_point isn't symmetric, 2967| | * but this API is only used for the product of file and screen gamma so it 2968| | * doesn't matter that the smallest number it can produce is 1/21474, not 2969| | * 1/100000 2970| | */ 2971| | png_fixed_point res = png_product2(a, b); 2972| | 2973| | if (res != 0) 2974| | return png_reciprocal(res); 2975| |#endif 2976| | 2977| 2| return 0; /* overflow */ 2978| 812|} OSS_FUZZ_png_gamma_8bit_correct: 3274| 113k|{ 3275| 113k| if (value > 0 && value < 255) ------------------ | Branch (3275:8): [True: 112k, False: 717] | Branch (3275:21): [True: 112k, False: 443] ------------------ 3276| 112k| { 3277| 112k|# ifdef PNG_FLOATING_ARITHMETIC_SUPPORTED 3278| | /* 'value' is unsigned, ANSI-C90 requires the compiler to correctly 3279| | * convert this to a floating point value. This includes values that 3280| | * would overflow if 'value' were to be converted to 'int'. 3281| | * 3282| | * Apparently GCC, however, does an intermediate conversion to (int) 3283| | * on some (ARM) but not all (x86) platforms, possibly because of 3284| | * hardware FP limitations. (E.g. if the hardware conversion always 3285| | * assumes the integer register contains a signed value.) This results 3286| | * in ANSI-C undefined behavior for large values. 3287| | * 3288| | * Other implementations on the same machine might actually be ANSI-C90 3289| | * conformant and therefore compile spurious extra code for the large 3290| | * values. 3291| | * 3292| | * We can be reasonably sure that an unsigned to float conversion 3293| | * won't be faster than an int to float one. Therefore this code 3294| | * assumes responsibility for the undefined behavior, which it knows 3295| | * can't happen because of the check above. 3296| | * 3297| | * Note the argument to this routine is an (unsigned int) because, on 3298| | * 16-bit platforms, it is assigned a value which might be out of 3299| | * range for an (int); that would result in undefined behavior in the 3300| | * caller if the *argument* ('value') were to be declared (int). 3301| | */ 3302| 112k| double r = floor(255*pow((int)/*SAFE*/value/255.,gamma_val*.00001)+.5); 3303| 112k| return (png_byte)r; 3304| |# else 3305| | png_int_32 lg2 = png_log8bit(value); 3306| | png_fixed_point res; 3307| | 3308| | if (png_muldiv(&res, gamma_val, lg2, PNG_FP_1) != 0) 3309| | return png_exp8bit(res); 3310| | 3311| | /* Overflow. */ 3312| | value = 0; 3313| |# endif 3314| 112k| } 3315| | 3316| 1.16k| return (png_byte)(value & 0xff); 3317| 113k|} OSS_FUZZ_png_gamma_16bit_correct: 3322| 52.9k|{ 3323| 52.9k| if (value > 0 && value < 65535) ------------------ | Branch (3323:8): [True: 52.5k, False: 438] | Branch (3323:21): [True: 52.5k, False: 0] ------------------ 3324| 52.5k| { 3325| 52.5k|# ifdef PNG_FLOATING_ARITHMETIC_SUPPORTED 3326| | /* The same (unsigned int)->(double) constraints apply here as above, 3327| | * however in this case the (unsigned int) to (int) conversion can 3328| | * overflow on an ANSI-C90 compliant system so the cast needs to ensure 3329| | * that this is not possible. 3330| | */ 3331| 52.5k| double r = floor(65535*pow((png_int_32)value/65535., 3332| 52.5k| gamma_val*.00001)+.5); 3333| 52.5k| return (png_uint_16)r; 3334| |# else 3335| | png_int_32 lg2 = png_log16bit(value); 3336| | png_fixed_point res; 3337| | 3338| | if (png_muldiv(&res, gamma_val, lg2, PNG_FP_1) != 0) 3339| | return png_exp16bit(res); 3340| | 3341| | /* Overflow. */ 3342| | value = 0; 3343| |# endif 3344| 52.5k| } 3345| | 3346| 438| return (png_uint_16)value; 3347| 52.9k|} OSS_FUZZ_png_gamma_correct: 3358| 712|{ 3359| 712| if (png_ptr->bit_depth == 8) ------------------ | Branch (3359:8): [True: 274, False: 438] ------------------ 3360| 274| return png_gamma_8bit_correct(value, gamma_val); ------------------ | | 95| 274|#define png_gamma_8bit_correct OSS_FUZZ_png_gamma_8bit_correct ------------------ 3361| | 3362| 438|#ifdef PNG_16BIT_SUPPORTED 3363| 438| else 3364| 438| return png_gamma_16bit_correct(value, gamma_val); ------------------ | | 94| 438|#define png_gamma_16bit_correct OSS_FUZZ_png_gamma_16bit_correct ------------------ 3365| |#else 3366| | /* should not reach this */ 3367| | return 0; 3368| |#endif /* 16BIT */ 3369| 712|} OSS_FUZZ_png_destroy_gamma_table: 3546| 6.52k|{ 3547| 6.52k| png_free(png_ptr, png_ptr->gamma_table); ------------------ | | 253| 6.52k|#define png_free OSS_FUZZ_png_free ------------------ 3548| 6.52k| png_ptr->gamma_table = NULL; 3549| | 3550| 6.52k|#ifdef PNG_16BIT_SUPPORTED 3551| 6.52k| if (png_ptr->gamma_16_table != NULL) ------------------ | Branch (3551:8): [True: 206, False: 6.32k] ------------------ 3552| 206| { 3553| 206| int i; 3554| 206| int istop = (1 << (8 - png_ptr->gamma_shift)); 3555| 1.84k| for (i = 0; i < istop; i++) ------------------ | Branch (3555:19): [True: 1.63k, False: 206] ------------------ 3556| 1.63k| { 3557| 1.63k| png_free(png_ptr, png_ptr->gamma_16_table[i]); ------------------ | | 253| 1.63k|#define png_free OSS_FUZZ_png_free ------------------ 3558| 1.63k| } 3559| 206| png_free(png_ptr, png_ptr->gamma_16_table); ------------------ | | 253| 206|#define png_free OSS_FUZZ_png_free ------------------ 3560| 206| png_ptr->gamma_16_table = NULL; 3561| 206| } 3562| 6.52k|#endif /* 16BIT */ 3563| | 3564| 6.52k|#if defined(PNG_READ_BACKGROUND_SUPPORTED) || \ 3565| 6.52k| defined(PNG_READ_ALPHA_MODE_SUPPORTED) || \ 3566| 6.52k| defined(PNG_READ_RGB_TO_GRAY_SUPPORTED) 3567| 6.52k| png_free(png_ptr, png_ptr->gamma_from_1); ------------------ | | 253| 6.52k|#define png_free OSS_FUZZ_png_free ------------------ 3568| 6.52k| png_ptr->gamma_from_1 = NULL; 3569| 6.52k| png_free(png_ptr, png_ptr->gamma_to_1); ------------------ | | 253| 6.52k|#define png_free OSS_FUZZ_png_free ------------------ 3570| 6.52k| png_ptr->gamma_to_1 = NULL; 3571| | 3572| 6.52k|#ifdef PNG_16BIT_SUPPORTED 3573| 6.52k| if (png_ptr->gamma_16_from_1 != NULL) ------------------ | Branch (3573:8): [True: 177, False: 6.35k] ------------------ 3574| 177| { 3575| 177| int i; 3576| 177| int istop = (1 << (8 - png_ptr->gamma_shift)); 3577| 1.58k| for (i = 0; i < istop; i++) ------------------ | Branch (3577:19): [True: 1.40k, False: 177] ------------------ 3578| 1.40k| { 3579| 1.40k| png_free(png_ptr, png_ptr->gamma_16_from_1[i]); ------------------ | | 253| 1.40k|#define png_free OSS_FUZZ_png_free ------------------ 3580| 1.40k| } 3581| 177| png_free(png_ptr, png_ptr->gamma_16_from_1); ------------------ | | 253| 177|#define png_free OSS_FUZZ_png_free ------------------ 3582| 177| png_ptr->gamma_16_from_1 = NULL; 3583| 177| } 3584| 6.52k| if (png_ptr->gamma_16_to_1 != NULL) ------------------ | Branch (3584:8): [True: 177, False: 6.35k] ------------------ 3585| 177| { 3586| 177| int i; 3587| 177| int istop = (1 << (8 - png_ptr->gamma_shift)); 3588| 1.58k| for (i = 0; i < istop; i++) ------------------ | Branch (3588:19): [True: 1.40k, False: 177] ------------------ 3589| 1.40k| { 3590| 1.40k| png_free(png_ptr, png_ptr->gamma_16_to_1[i]); ------------------ | | 253| 1.40k|#define png_free OSS_FUZZ_png_free ------------------ 3591| 1.40k| } 3592| 177| png_free(png_ptr, png_ptr->gamma_16_to_1); ------------------ | | 253| 177|#define png_free OSS_FUZZ_png_free ------------------ 3593| | png_ptr->gamma_16_to_1 = NULL; 3594| 177| } 3595| 6.52k|#endif /* 16BIT */ 3596| 6.52k|#endif /* READ_BACKGROUND || READ_ALPHA_MODE || RGB_TO_GRAY */ 3597| 6.52k|} OSS_FUZZ_png_build_gamma_table: 3617| 456|{ 3618| 456| png_fixed_point file_gamma, screen_gamma; 3619| 456| png_fixed_point correction; 3620| 456|# if GAMMA_TRANSFORMS 3621| 456| png_fixed_point file_to_linear, linear_to_screen; 3622| 456|# endif 3623| | 3624| 456| png_debug(1, "in png_build_gamma_table"); ------------------ | | 145| 456|# define png_debug(l, m) ((void)0) ------------------ 3625| | 3626| | /* Remove any existing table; this copes with multiple calls to 3627| | * png_read_update_info. The warning is because building the gamma tables 3628| | * multiple times is a performance hit - it's harmless but the ability to 3629| | * call png_read_update_info() multiple times is new in 1.5.6 so it seems 3630| | * sensible to warn if the app introduces such a hit. 3631| | */ 3632| 456| if (png_ptr->gamma_table != NULL || png_ptr->gamma_16_table != NULL) ------------------ | Branch (3632:8): [True: 0, False: 456] | Branch (3632:40): [True: 0, False: 456] ------------------ 3633| 0| { 3634| 0| png_warning(png_ptr, "gamma table being rebuilt"); ------------------ | | 450| 0|#define png_warning OSS_FUZZ_png_warning ------------------ 3635| 0| png_destroy_gamma_table(png_ptr); ------------------ | | 96| 0|#define png_destroy_gamma_table OSS_FUZZ_png_destroy_gamma_table ------------------ 3636| 0| } 3637| | 3638| | /* The following fields are set, finally, in png_init_read_transformations. 3639| | * If file_gamma is 0 (unset) nothing can be done otherwise if screen_gamma 3640| | * is 0 (unset) there is no gamma correction but to/from linear is possible. 3641| | */ 3642| 456| file_gamma = png_ptr->file_gamma; 3643| 456| screen_gamma = png_ptr->screen_gamma; 3644| 456|# if GAMMA_TRANSFORMS 3645| 456| file_to_linear = png_reciprocal(file_gamma); ------------------ | | 89| 456|#define png_reciprocal OSS_FUZZ_png_reciprocal ------------------ 3646| 456|# endif 3647| | 3648| 456| if (screen_gamma > 0) ------------------ | Branch (3648:8): [True: 456, False: 0] ------------------ 3649| 456| { 3650| 456|# if GAMMA_TRANSFORMS 3651| 456| linear_to_screen = png_reciprocal(screen_gamma); ------------------ | | 89| 456|#define png_reciprocal OSS_FUZZ_png_reciprocal ------------------ 3652| 456|# endif 3653| 456| correction = png_reciprocal2(screen_gamma, file_gamma); ------------------ | | 90| 456|#define png_reciprocal2 OSS_FUZZ_png_reciprocal2 ------------------ 3654| 456| } 3655| 0| else /* screen gamma unknown */ 3656| 0| { 3657| 0|# if GAMMA_TRANSFORMS 3658| 0| linear_to_screen = file_gamma; 3659| 0|# endif 3660| 0| correction = PNG_FP_1; ------------------ | | 654| 0|#define PNG_FP_1 100000 ------------------ 3661| 0| } 3662| | 3663| 456| if (bit_depth <= 8) ------------------ | Branch (3663:8): [True: 250, False: 206] ------------------ 3664| 250| { 3665| 250| png_build_8bit_table(png_ptr, &png_ptr->gamma_table, correction); 3666| | 3667| 250|#if GAMMA_TRANSFORMS 3668| 250| if ((png_ptr->transformations & (PNG_COMPOSE | PNG_RGB_TO_GRAY)) != 0) ------------------ | | 665| 250|#define PNG_COMPOSE 0x0080U /* Was PNG_BACKGROUND */ ------------------ if ((png_ptr->transformations & (PNG_COMPOSE | PNG_RGB_TO_GRAY)) != 0) ------------------ | | 681| 250|#define PNG_RGB_TO_GRAY 0x600000U /* two bits, RGB_TO_GRAY_ERR|WARN */ ------------------ | Branch (3668:11): [True: 193, False: 57] ------------------ 3669| 193| { 3670| 193| png_build_8bit_table(png_ptr, &png_ptr->gamma_to_1, file_to_linear); 3671| | 3672| 193| png_build_8bit_table(png_ptr, &png_ptr->gamma_from_1, 3673| 193| linear_to_screen); 3674| 193| } 3675| 250|#endif /* GAMMA_TRANSFORMS */ 3676| 250| } 3677| 206|#ifdef PNG_16BIT_SUPPORTED 3678| 206| else 3679| 206| { 3680| 206| png_byte shift, sig_bit; 3681| | 3682| 206| if ((png_ptr->color_type & PNG_COLOR_MASK_COLOR) != 0) ------------------ | | 662| 206|#define PNG_COLOR_MASK_COLOR 2 ------------------ | Branch (3682:11): [True: 122, False: 84] ------------------ 3683| 122| { 3684| 122| sig_bit = png_ptr->sig_bit.red; 3685| | 3686| 122| if (png_ptr->sig_bit.green > sig_bit) ------------------ | Branch (3686:14): [True: 0, False: 122] ------------------ 3687| 0| sig_bit = png_ptr->sig_bit.green; 3688| | 3689| 122| if (png_ptr->sig_bit.blue > sig_bit) ------------------ | Branch (3689:14): [True: 0, False: 122] ------------------ 3690| 0| sig_bit = png_ptr->sig_bit.blue; 3691| 122| } 3692| 84| else 3693| 84| sig_bit = png_ptr->sig_bit.gray; 3694| | 3695| | /* 16-bit gamma code uses this equation: 3696| | * 3697| | * ov = table[(iv & 0xff) >> gamma_shift][iv >> 8] 3698| | * 3699| | * Where 'iv' is the input color value and 'ov' is the output value - 3700| | * pow(iv, gamma). 3701| | * 3702| | * Thus the gamma table consists of up to 256 256-entry tables. The table 3703| | * is selected by the (8-gamma_shift) most significant of the low 8 bits 3704| | * of the color value then indexed by the upper 8 bits: 3705| | * 3706| | * table[low bits][high 8 bits] 3707| | * 3708| | * So the table 'n' corresponds to all those 'iv' of: 3709| | * 3710| | * ..<(n+1 << gamma_shift)-1> 3711| | * 3712| | */ 3713| 206| if (sig_bit > 0 && sig_bit < 16U) ------------------ | Branch (3713:11): [True: 2, False: 204] | Branch (3713:26): [True: 2, False: 0] ------------------ 3714| | /* shift == insignificant bits */ 3715| 2| shift = (png_byte)((16U - sig_bit) & 0xff); 3716| | 3717| 204| else 3718| 204| shift = 0; /* keep all 16 bits */ 3719| | 3720| 206| if ((png_ptr->transformations & (PNG_16_TO_8 | PNG_SCALE_16_TO_8)) != 0) ------------------ | | 668| 206|#define PNG_16_TO_8 0x0400U /* Becomes 'chop' in 1.5.4 */ ------------------ if ((png_ptr->transformations & (PNG_16_TO_8 | PNG_SCALE_16_TO_8)) != 0) ------------------ | | 685| 206|#define PNG_SCALE_16_TO_8 0x4000000U /* Added to libpng-1.5.4 */ ------------------ | Branch (3720:11): [True: 206, False: 0] ------------------ 3721| 206| { 3722| | /* PNG_MAX_GAMMA_8 is the number of bits to keep - effectively 3723| | * the significant bits in the *input* when the output will 3724| | * eventually be 8 bits. By default it is 11. 3725| | */ 3726| 206| if (shift < (16U - PNG_MAX_GAMMA_8)) ------------------ | | 215| 206|#define PNG_MAX_GAMMA_8 11 ------------------ | Branch (3726:14): [True: 204, False: 2] ------------------ 3727| 204| shift = (16U - PNG_MAX_GAMMA_8); ------------------ | | 215| 204|#define PNG_MAX_GAMMA_8 11 ------------------ 3728| 206| } 3729| | 3730| 206| if (shift > 8U) ------------------ | Branch (3730:11): [True: 2, False: 204] ------------------ 3731| 2| shift = 8U; /* Guarantees at least one table! */ 3732| | 3733| 206| png_ptr->gamma_shift = shift; 3734| | 3735| | /* NOTE: prior to 1.5.4 this test used to include PNG_BACKGROUND (now 3736| | * PNG_COMPOSE). This effectively smashed the background calculation for 3737| | * 16-bit output because the 8-bit table assumes the result will be 3738| | * reduced to 8 bits. 3739| | */ 3740| 206| if ((png_ptr->transformations & (PNG_16_TO_8 | PNG_SCALE_16_TO_8)) != 0) ------------------ | | 668| 206|#define PNG_16_TO_8 0x0400U /* Becomes 'chop' in 1.5.4 */ ------------------ if ((png_ptr->transformations & (PNG_16_TO_8 | PNG_SCALE_16_TO_8)) != 0) ------------------ | | 685| 206|#define PNG_SCALE_16_TO_8 0x4000000U /* Added to libpng-1.5.4 */ ------------------ | Branch (3740:11): [True: 206, False: 0] ------------------ 3741| 206| png_build_16to8_table(png_ptr, &png_ptr->gamma_16_table, shift, 3742| 206| png_reciprocal(correction)); ------------------ | | 89| 206|#define png_reciprocal OSS_FUZZ_png_reciprocal ------------------ 3743| 0| else 3744| 0| png_build_16bit_table(png_ptr, &png_ptr->gamma_16_table, shift, 3745| 0| correction); 3746| | 3747| 206|# if GAMMA_TRANSFORMS 3748| 206| if ((png_ptr->transformations & (PNG_COMPOSE | PNG_RGB_TO_GRAY)) != 0) ------------------ | | 665| 206|#define PNG_COMPOSE 0x0080U /* Was PNG_BACKGROUND */ ------------------ if ((png_ptr->transformations & (PNG_COMPOSE | PNG_RGB_TO_GRAY)) != 0) ------------------ | | 681| 206|#define PNG_RGB_TO_GRAY 0x600000U /* two bits, RGB_TO_GRAY_ERR|WARN */ ------------------ | Branch (3748:11): [True: 177, False: 29] ------------------ 3749| 177| { 3750| 177| png_build_16bit_table(png_ptr, &png_ptr->gamma_16_to_1, shift, 3751| 177| file_to_linear); 3752| | 3753| | /* Notice that the '16 from 1' table should be full precision, however 3754| | * the lookup on this table still uses gamma_shift, so it can't be. 3755| | * TODO: fix this. 3756| | */ 3757| 177| png_build_16bit_table(png_ptr, &png_ptr->gamma_16_from_1, shift, 3758| 177| linear_to_screen); 3759| 177| } 3760| 206|#endif /* GAMMA_TRANSFORMS */ 3761| 206| } 3762| 456|#endif /* 16BIT */ 3763| 456|} png.c:icc_check_length: 1587| 6.79k|{ 1588| 6.79k| if (profile_length < 132) ------------------ | Branch (1588:8): [True: 203, False: 6.59k] ------------------ 1589| 203| return png_icc_profile_error(png_ptr, name, profile_length, "too short"); 1590| 6.59k| return 1; 1591| 6.79k|} png.c:png_icc_profile_error: 1541| 24.1k|{ 1542| 24.1k| size_t pos; 1543| 24.1k| char message[196]; /* see below for calculation */ 1544| | 1545| 24.1k| pos = png_safecat(message, (sizeof message), 0, "profile '"); /* 9 chars */ ------------------ | | 75| 24.1k|#define png_safecat OSS_FUZZ_png_safecat ------------------ 1546| 24.1k| pos = png_safecat(message, pos+79, pos, name); /* Truncate to 79 chars */ ------------------ | | 75| 24.1k|#define png_safecat OSS_FUZZ_png_safecat ------------------ 1547| 24.1k| pos = png_safecat(message, (sizeof message), pos, "': "); /* +2 = 90 */ ------------------ | | 75| 24.1k|#define png_safecat OSS_FUZZ_png_safecat ------------------ 1548| 24.1k| if (is_ICC_signature(value) != 0) ------------------ | Branch (1548:8): [True: 2.87k, False: 21.2k] ------------------ 1549| 2.87k| { 1550| | /* So 'value' is at most 4 bytes and the following cast is safe */ 1551| 2.87k| png_icc_tag_name(message+pos, (png_uint_32)value); 1552| 2.87k| pos += 6; /* total +8; less than the else clause */ 1553| 2.87k| message[pos++] = ':'; 1554| 2.87k| message[pos++] = ' '; 1555| 2.87k| } 1556| 21.2k|# ifdef PNG_WARNINGS_SUPPORTED 1557| 21.2k| else 1558| 21.2k| { 1559| 21.2k| char number[PNG_NUMBER_BUFFER_SIZE]; /* +24 = 114 */ 1560| | 1561| 21.2k| pos = png_safecat(message, (sizeof message), pos, ------------------ | | 75| 21.2k|#define png_safecat OSS_FUZZ_png_safecat ------------------ 1562| 21.2k| png_format_number(number, number+(sizeof number), ------------------ | | 76| 21.2k|#define png_format_number OSS_FUZZ_png_format_number ------------------ 1563| 21.2k| PNG_NUMBER_FORMAT_x, value)); ------------------ | | 1966| 21.2k|#define PNG_NUMBER_FORMAT_x 3 ------------------ 1564| 21.2k| pos = png_safecat(message, (sizeof message), pos, "h: "); /* +2 = 116 */ ------------------ | | 75| 21.2k|#define png_safecat OSS_FUZZ_png_safecat ------------------ 1565| 21.2k| } 1566| 24.1k|# endif 1567| | /* The 'reason' is an arbitrary message, allow +79 maximum 195 */ 1568| 24.1k| pos = png_safecat(message, (sizeof message), pos, reason); ------------------ | | 75| 24.1k|#define png_safecat OSS_FUZZ_png_safecat ------------------ 1569| 24.1k| PNG_UNUSED(pos) ------------------ | | 479| 24.1k|# define PNG_UNUSED(param) (void)param; ------------------ 1570| | 1571| 24.1k| png_chunk_benign_error(png_ptr, message); ------------------ | | 238| 24.1k|#define png_chunk_benign_error OSS_FUZZ_png_chunk_benign_error ------------------ 1572| | 1573| 24.1k| return 0; 1574| 24.1k|} png.c:is_ICC_signature: 1531| 24.1k|{ 1532| 24.1k| return is_ICC_signature_char(it >> 24) /* checks all the top bits */ && ------------------ | Branch (1532:11): [True: 7.65k, False: 16.5k] ------------------ 1533| 7.65k| is_ICC_signature_char((it >> 16) & 0xff) && ------------------ | Branch (1533:7): [True: 6.34k, False: 1.30k] ------------------ 1534| 6.34k| is_ICC_signature_char((it >> 8) & 0xff) && ------------------ | Branch (1534:7): [True: 4.10k, False: 2.24k] ------------------ 1535| 4.10k| is_ICC_signature_char(it & 0xff); ------------------ | Branch (1535:7): [True: 2.87k, False: 1.23k] ------------------ 1536| 24.1k|} png.c:is_ICC_signature_char: 1524| 42.2k|{ 1525| 42.2k| return it == 32 || (it >= 48 && it <= 57) || (it >= 65 && it <= 90) || ------------------ | Branch (1525:11): [True: 2.03k, False: 40.2k] | Branch (1525:24): [True: 22.6k, False: 17.5k] | Branch (1525:36): [True: 2.49k, False: 20.1k] | Branch (1525:50): [True: 18.8k, False: 18.9k] | Branch (1525:62): [True: 9.16k, False: 9.64k] ------------------ 1526| 28.5k| (it >= 97 && it <= 122); ------------------ | Branch (1526:8): [True: 9.03k, False: 19.5k] | Branch (1526:20): [True: 7.29k, False: 1.74k] ------------------ 1527| 42.2k|} png.c:png_icc_tag_name: 1513| 2.87k|{ 1514| 2.87k| name[0] = '\''; 1515| 2.87k| name[1] = png_icc_tag_char(tag >> 24); 1516| 2.87k| name[2] = png_icc_tag_char(tag >> 16); 1517| 2.87k| name[3] = png_icc_tag_char(tag >> 8); 1518| 2.87k| name[4] = png_icc_tag_char(tag ); 1519| 2.87k| name[5] = '\''; 1520| 2.87k|} png.c:png_icc_tag_char: 1503| 11.4k|{ 1504| 11.4k| byte &= 0xff; 1505| 11.4k| if (byte >= 32 && byte <= 126) ------------------ | Branch (1505:8): [True: 11.4k, False: 0] | Branch (1505:22): [True: 11.4k, False: 0] ------------------ 1506| 11.4k| return (char)byte; 1507| 0| else 1508| 0| return '?'; 1509| 11.4k|} png.c:png_build_8bit_table: 3528| 636|{ 3529| 636| unsigned int i; 3530| 636| png_bytep table = *ptable = (png_bytep)png_malloc(png_ptr, 256); ------------------ | | 347| 636|#define png_malloc OSS_FUZZ_png_malloc ------------------ 3531| | 3532| 636| if (png_gamma_significant(gamma_val) != 0) ------------------ | | 91| 636|#define png_gamma_significant OSS_FUZZ_png_gamma_significant ------------------ | Branch (3532:8): [True: 443, False: 193] ------------------ 3533| 113k| for (i=0; i<256; i++) ------------------ | Branch (3533:17): [True: 113k, False: 443] ------------------ 3534| 113k| table[i] = png_gamma_8bit_correct(i, gamma_val); ------------------ | | 95| 113k|#define png_gamma_8bit_correct OSS_FUZZ_png_gamma_8bit_correct ------------------ 3535| | 3536| 193| else 3537| 49.6k| for (i=0; i<256; ++i) ------------------ | Branch (3537:17): [True: 49.4k, False: 193] ------------------ 3538| 49.4k| table[i] = (png_byte)(i & 0xff); 3539| 636|} png.c:png_build_16to8_table: 3460| 206|{ 3461| 206| unsigned int num = 1U << (8U - shift); 3462| 206| unsigned int max = (1U << (16U - shift))-1U; 3463| 206| unsigned int i; 3464| 206| png_uint_32 last; 3465| | 3466| 206| png_uint_16pp table = *ptable = 3467| 206| (png_uint_16pp)png_calloc(png_ptr, num * (sizeof (png_uint_16p))); ------------------ | | 237| 206|#define png_calloc OSS_FUZZ_png_calloc ------------------ 3468| | 3469| | /* 'num' is the number of tables and also the number of low bits of low 3470| | * bits of the input 16-bit value used to select a table. Each table is 3471| | * itself indexed by the high 8 bits of the value. 3472| | */ 3473| 1.84k| for (i = 0; i < num; i++) ------------------ | Branch (3473:16): [True: 1.63k, False: 206] ------------------ 3474| 1.63k| table[i] = (png_uint_16p)png_malloc(png_ptr, ------------------ | | 347| 1.63k|#define png_malloc OSS_FUZZ_png_malloc ------------------ 3475| 1.63k| 256 * (sizeof (png_uint_16))); 3476| | 3477| | /* 'gamma_val' is set to the reciprocal of the value calculated above, so 3478| | * pow(out,g) is an *input* value. 'last' is the last input value set. 3479| | * 3480| | * In the loop 'i' is used to find output values. Since the output is 3481| | * 8-bit there are only 256 possible values. The tables are set up to 3482| | * select the closest possible output value for each input by finding 3483| | * the input value at the boundary between each pair of output values 3484| | * and filling the table up to that boundary with the lower output 3485| | * value. 3486| | * 3487| | * The boundary values are 0.5,1.5..253.5,254.5. Since these are 9-bit 3488| | * values the code below uses a 16-bit value in i; the values start at 3489| | * 128.5 (for 0.5) and step by 257, for a total of 254 values (the last 3490| | * entries are filled with 255). Start i at 128 and fill all 'last' 3491| | * table entries <= 'max' 3492| | */ 3493| 206| last = 0; 3494| 52.7k| for (i = 0; i < 255; ++i) /* 8-bit output value */ ------------------ | Branch (3494:16): [True: 52.5k, False: 206] ------------------ 3495| 52.5k| { 3496| | /* Find the corresponding maximum input value */ 3497| 52.5k| png_uint_16 out = (png_uint_16)(i * 257U); /* 16-bit output value */ 3498| | 3499| | /* Find the boundary value in 16 bits: */ 3500| 52.5k| png_uint_32 bound = png_gamma_16bit_correct(out+128U, gamma_val); ------------------ | | 94| 52.5k|#define png_gamma_16bit_correct OSS_FUZZ_png_gamma_16bit_correct ------------------ 3501| | 3502| | /* Adjust (round) to (16-shift) bits: */ 3503| 52.5k| bound = (bound * max + 32768U)/65535U + 1U; 3504| | 3505| 461k| while (last < bound) ------------------ | Branch (3505:14): [True: 408k, False: 52.5k] ------------------ 3506| 408k| { 3507| 408k| table[last & (0xffU >> shift)][last >> (8U - shift)] = out; 3508| 408k| last++; 3509| 408k| } 3510| 52.5k| } 3511| | 3512| | /* And fill in the final entries. */ 3513| 9.96k| while (last < (num << 8)) ------------------ | Branch (3513:11): [True: 9.75k, False: 206] ------------------ 3514| 9.75k| { 3515| 9.75k| table[last & (0xff >> shift)][last >> (8U - shift)] = 65535U; 3516| 9.75k| last++; 3517| 9.75k| } 3518| 206|} png.c:png_build_16bit_table: 3383| 354|{ 3384| | /* Various values derived from 'shift': */ 3385| 354| unsigned int num = 1U << (8U - shift); 3386| 354|#ifdef PNG_FLOATING_ARITHMETIC_SUPPORTED 3387| | /* CSE the division and work round wacky GCC warnings (see the comments 3388| | * in png_gamma_8bit_correct for where these come from.) 3389| | */ 3390| 354| double fmax = 1.0 / (((png_int_32)1 << (16U - shift)) - 1); 3391| 354|#endif 3392| 354| unsigned int max = (1U << (16U - shift)) - 1U; 3393| 354| unsigned int max_by_2 = 1U << (15U - shift); 3394| 354| unsigned int i; 3395| | 3396| 354| png_uint_16pp table = *ptable = 3397| 354| (png_uint_16pp)png_calloc(png_ptr, num * (sizeof (png_uint_16p))); ------------------ | | 237| 354|#define png_calloc OSS_FUZZ_png_calloc ------------------ 3398| | 3399| 3.17k| for (i = 0; i < num; i++) ------------------ | Branch (3399:16): [True: 2.81k, False: 354] ------------------ 3400| 2.81k| { 3401| 2.81k| png_uint_16p sub_table = table[i] = 3402| 2.81k| (png_uint_16p)png_malloc(png_ptr, 256 * (sizeof (png_uint_16))); ------------------ | | 347| 2.81k|#define png_malloc OSS_FUZZ_png_malloc ------------------ 3403| | 3404| | /* The 'threshold' test is repeated here because it can arise for one of 3405| | * the 16-bit tables even if the others don't hit it. 3406| | */ 3407| 2.81k| if (png_gamma_significant(gamma_val) != 0) ------------------ | | 91| 2.81k|#define png_gamma_significant OSS_FUZZ_png_gamma_significant ------------------ | Branch (3407:11): [True: 1.40k, False: 1.40k] ------------------ 3408| 1.40k| { 3409| | /* The old code would overflow at the end and this would cause the 3410| | * 'pow' function to return a result >1, resulting in an 3411| | * arithmetic error. This code follows the spec exactly; ig is 3412| | * the recovered input sample, it always has 8-16 bits. 3413| | * 3414| | * We want input * 65535/max, rounded, the arithmetic fits in 32 3415| | * bits (unsigned) so long as max <= 32767. 3416| | */ 3417| 1.40k| unsigned int j; 3418| 362k| for (j = 0; j < 256; j++) ------------------ | Branch (3418:22): [True: 360k, False: 1.40k] ------------------ 3419| 360k| { 3420| 360k| png_uint_32 ig = (j << (8-shift)) + i; 3421| 360k|# ifdef PNG_FLOATING_ARITHMETIC_SUPPORTED 3422| | /* Inline the 'max' scaling operation: */ 3423| | /* See png_gamma_8bit_correct for why the cast to (int) is 3424| | * required here. 3425| | */ 3426| 360k| double d = floor(65535.*pow(ig*fmax, gamma_val*.00001)+.5); 3427| 360k| sub_table[j] = (png_uint_16)d; 3428| |# else 3429| | if (shift != 0) 3430| | ig = (ig * 65535U + max_by_2)/max; 3431| | 3432| | sub_table[j] = png_gamma_16bit_correct(ig, gamma_val); 3433| |# endif 3434| 360k| } 3435| 1.40k| } 3436| 1.40k| else 3437| 1.40k| { 3438| | /* We must still build a table, but do it the fast way. */ 3439| 1.40k| unsigned int j; 3440| | 3441| 362k| for (j = 0; j < 256; j++) ------------------ | Branch (3441:22): [True: 360k, False: 1.40k] ------------------ 3442| 360k| { 3443| 360k| png_uint_32 ig = (j << (8-shift)) + i; 3444| | 3445| 360k| if (shift != 0) ------------------ | Branch (3445:17): [True: 360k, False: 0] ------------------ 3446| 360k| ig = (ig * 65535U + max_by_2)/max; 3447| | 3448| 360k| sub_table[j] = (png_uint_16)ig; 3449| 360k| } 3450| 1.40k| } 3451| 2.81k| } 3452| 354|} OSS_FUZZ_png_error: 41| 6.46k|{ 42| 6.46k| if (png_ptr != NULL && png_ptr->error_fn != NULL) ------------------ | Branch (42:8): [True: 6.46k, False: 0] | Branch (42:27): [True: 0, False: 6.46k] ------------------ 43| 0| (*(png_ptr->error_fn))(png_constcast(png_structrp,png_ptr), ------------------ | | 536| 0|# define png_constcast(type, value) ((type)(void*)(const void*)(value)) ------------------ 44| 0| error_message); 45| | 46| | /* If the custom handler doesn't exist, or if it returns, 47| | use the default handler, which will not return. */ 48| 6.46k| png_default_error(png_ptr, error_message); 49| 6.46k|} OSS_FUZZ_png_safecat: 75| 139k|{ 76| 139k| if (buffer != NULL && pos < bufsize) ------------------ | Branch (76:8): [True: 139k, False: 0] | Branch (76:26): [True: 139k, False: 0] ------------------ 77| 139k| { 78| 139k| if (string != NULL) ------------------ | Branch (78:11): [True: 139k, False: 0] ------------------ 79| 1.56M| while (*string != '\0' && pos < bufsize-1) ------------------ | Branch (79:17): [True: 1.42M, False: 139k] | Branch (79:36): [True: 1.42M, False: 2] ------------------ 80| 1.42M| buffer[pos++] = *string++; 81| | 82| 139k| buffer[pos] = '\0'; 83| 139k| } 84| | 85| 139k| return pos; 86| 139k|} OSS_FUZZ_png_format_number: 96| 21.2k|{ 97| 21.2k| int count = 0; /* number of digits output */ 98| 21.2k| int mincount = 1; /* minimum number required */ 99| 21.2k| int output = 0; /* digit output (for the fixed point format) */ 100| | 101| 21.2k| *--end = '\0'; 102| | 103| | /* This is written so that the loop always runs at least once, even with 104| | * number zero. 105| | */ 106| 109k| while (end > start && (number != 0 || count < mincount)) ------------------ | Branch (106:11): [True: 109k, False: 0] | Branch (106:27): [True: 83.9k, False: 25.9k] | Branch (106:42): [True: 4.67k, False: 21.2k] ------------------ 107| 88.5k| { 108| | 109| 88.5k| static const char digits[] = "0123456789ABCDEF"; 110| | 111| 88.5k| switch (format) 112| 88.5k| { 113| 0| case PNG_NUMBER_FORMAT_fixed: ------------------ | | 1968| 0|#define PNG_NUMBER_FORMAT_fixed 5 /* choose the signed API */ ------------------ | Branch (113:10): [True: 0, False: 88.5k] ------------------ 114| | /* Needs five digits (the fraction) */ 115| 0| mincount = 5; 116| 0| if (output != 0 || number % 10 != 0) ------------------ | Branch (116:17): [True: 0, False: 0] | Branch (116:32): [True: 0, False: 0] ------------------ 117| 0| { 118| 0| *--end = digits[number % 10]; 119| 0| output = 1; 120| 0| } 121| 0| number /= 10; 122| 0| break; 123| | 124| 0| case PNG_NUMBER_FORMAT_02u: ------------------ | | 1963| 0|#define PNG_NUMBER_FORMAT_02u 2 ------------------ | Branch (124:10): [True: 0, False: 88.5k] ------------------ 125| | /* Expects at least 2 digits. */ 126| 0| mincount = 2; 127| | /* FALLTHROUGH */ 128| | 129| 0| case PNG_NUMBER_FORMAT_u: ------------------ | | 1962| 0|#define PNG_NUMBER_FORMAT_u 1 /* chose unsigned API! */ ------------------ | Branch (129:10): [True: 0, False: 88.5k] ------------------ 130| 0| *--end = digits[number % 10]; 131| 0| number /= 10; 132| 0| break; 133| | 134| 0| case PNG_NUMBER_FORMAT_02x: ------------------ | | 1967| 0|#define PNG_NUMBER_FORMAT_02x 4 ------------------ | Branch (134:10): [True: 0, False: 88.5k] ------------------ 135| | /* This format expects at least two digits */ 136| 0| mincount = 2; 137| | /* FALLTHROUGH */ 138| | 139| 88.5k| case PNG_NUMBER_FORMAT_x: ------------------ | | 1966| 88.5k|#define PNG_NUMBER_FORMAT_x 3 ------------------ | Branch (139:10): [True: 88.5k, False: 0] ------------------ 140| 88.5k| *--end = digits[number & 0xf]; 141| 88.5k| number >>= 4; 142| 88.5k| break; 143| | 144| 0| default: /* an error */ ------------------ | Branch (144:10): [True: 0, False: 88.5k] ------------------ 145| 0| number = 0; 146| 0| break; 147| 88.5k| } 148| | 149| | /* Keep track of the number of digits added */ 150| 88.5k| ++count; 151| | 152| | /* Float a fixed number here: */ 153| 88.5k| if ((format == PNG_NUMBER_FORMAT_fixed) && (count == 5) && (end > start)) ------------------ | | 1968| 88.5k|#define PNG_NUMBER_FORMAT_fixed 5 /* choose the signed API */ ------------------ | Branch (153:11): [True: 0, False: 88.5k] | Branch (153:50): [True: 0, False: 0] | Branch (153:66): [True: 0, False: 0] ------------------ 154| 0| { 155| | /* End of the fraction, but maybe nothing was output? In that case 156| | * drop the decimal point. If the number is a true zero handle that 157| | * here. 158| | */ 159| 0| if (output != 0) ------------------ | Branch (159:14): [True: 0, False: 0] ------------------ 160| 0| *--end = '.'; 161| 0| else if (number == 0) /* and !output */ ------------------ | Branch (161:19): [True: 0, False: 0] ------------------ 162| 0| *--end = '0'; 163| 0| } 164| 88.5k| } 165| | 166| 21.2k| return end; 167| 21.2k|} OSS_FUZZ_png_warning: 178| 106k|{ 179| 106k| int offset = 0; 180| 106k| if (png_ptr != NULL && png_ptr->warning_fn != NULL) ------------------ | Branch (180:8): [True: 106k, False: 0] | Branch (180:27): [True: 0, False: 106k] ------------------ 181| 0| (*(png_ptr->warning_fn))(png_constcast(png_structrp,png_ptr), ------------------ | | 536| 0|# define png_constcast(type, value) ((type)(void*)(const void*)(value)) ------------------ 182| 0| warning_message + offset); 183| 106k| else 184| 106k| png_default_warning(png_ptr, warning_message + offset); 185| 106k|} OSS_FUZZ_png_chunk_error: 428| 358|{ 429| 358| char msg[18+PNG_MAX_ERROR_TEXT]; 430| 358| if (png_ptr == NULL) ------------------ | Branch (430:8): [True: 0, False: 358] ------------------ 431| 0| png_error(png_ptr, error_message); ------------------ | | 252| 0|#define png_error OSS_FUZZ_png_error ------------------ 432| | 433| 358| else 434| 358| { 435| 358| png_format_buffer(png_ptr, msg, error_message); 436| 358| png_error(png_ptr, msg); ------------------ | | 252| 716|#define png_error OSS_FUZZ_png_error ------------------ 437| 358| } 438| 358|} OSS_FUZZ_png_chunk_warning: 444| 94.5k|{ 445| 94.5k| char msg[18+PNG_MAX_ERROR_TEXT]; 446| 94.5k| if (png_ptr == NULL) ------------------ | Branch (446:8): [True: 0, False: 94.5k] ------------------ 447| 0| png_warning(png_ptr, warning_message); ------------------ | | 450| 0|#define png_warning OSS_FUZZ_png_warning ------------------ 448| | 449| 94.5k| else 450| 94.5k| { 451| 94.5k| png_format_buffer(png_ptr, msg, warning_message); 452| 94.5k| png_warning(png_ptr, msg); ------------------ | | 450| 94.5k|#define png_warning OSS_FUZZ_png_warning ------------------ 453| 94.5k| } 454| 94.5k|} OSS_FUZZ_png_chunk_benign_error: 462| 46.7k|{ 463| 46.7k| if ((png_ptr->flags & PNG_FLAG_BENIGN_ERRORS_WARN) != 0) ------------------ | | 715| 46.7k|#define PNG_FLAG_BENIGN_ERRORS_WARN 0x100000U /* Added to libpng-1.4.0 */ ------------------ | Branch (463:8): [True: 46.7k, False: 0] ------------------ 464| 46.7k| png_chunk_warning(png_ptr, error_message); ------------------ | | 240| 46.7k|#define png_chunk_warning OSS_FUZZ_png_chunk_warning ------------------ 465| | 466| 0| else 467| 0| png_chunk_error(png_ptr, error_message); ------------------ | | 239| 0|#define png_chunk_error OSS_FUZZ_png_chunk_error ------------------ 468| | 469| |# ifndef PNG_ERROR_TEXT_SUPPORTED 470| | PNG_UNUSED(error_message) 471| |# endif 472| 46.7k|} OSS_FUZZ_png_chunk_report: 478| 55|{ 479| |# ifndef PNG_WARNINGS_SUPPORTED 480| | PNG_UNUSED(message) 481| |# endif 482| | 483| | /* This is always supported, but for just read or just write it 484| | * unconditionally does the right thing. 485| | */ 486| |# if defined(PNG_READ_SUPPORTED) && defined(PNG_WRITE_SUPPORTED) 487| | if ((png_ptr->mode & PNG_IS_READ_STRUCT) != 0) 488| |# endif 489| | 490| 55|# ifdef PNG_READ_SUPPORTED 491| 55| { 492| 55| if (error < PNG_CHUNK_ERROR) ------------------ | | 2055| 55|#define PNG_CHUNK_ERROR 2 /* always an error */ ------------------ | Branch (492:14): [True: 55, False: 0] ------------------ 493| 55| png_chunk_warning(png_ptr, message); ------------------ | | 240| 55|#define png_chunk_warning OSS_FUZZ_png_chunk_warning ------------------ 494| | 495| 0| else 496| 0| png_chunk_benign_error(png_ptr, message); ------------------ | | 238| 0|#define png_chunk_benign_error OSS_FUZZ_png_chunk_benign_error ------------------ 497| 55| } 498| 55|# endif 499| | 500| |# if defined(PNG_READ_SUPPORTED) && defined(PNG_WRITE_SUPPORTED) 501| | else if ((png_ptr->mode & PNG_IS_READ_STRUCT) == 0) 502| |# endif 503| | 504| |# ifdef PNG_WRITE_SUPPORTED 505| | { 506| | if (error < PNG_CHUNK_WRITE_ERROR) 507| | png_app_warning(png_ptr, message); 508| | 509| | else 510| | png_app_error(png_ptr, message); 511| | } 512| |# endif 513| 55|} OSS_FUZZ_png_set_longjmp_fn: 546| 6.52k|{ 547| | /* From libpng 1.6.0 the app gets one chance to set a 'jmpbuf_size' value 548| | * and it must not change after that. Libpng doesn't care how big the 549| | * buffer is, just that it doesn't change. 550| | * 551| | * If the buffer size is no *larger* than the size of jmp_buf when libpng is 552| | * compiled a built in jmp_buf is returned; this preserves the pre-1.6.0 553| | * semantics that this call will not fail. If the size is larger, however, 554| | * the buffer is allocated and this may fail, causing the function to return 555| | * NULL. 556| | */ 557| 6.52k| if (png_ptr == NULL) ------------------ | Branch (557:8): [True: 0, False: 6.52k] ------------------ 558| 0| return NULL; 559| | 560| 6.52k| if (png_ptr->jmp_buf_ptr == NULL) ------------------ | Branch (560:8): [True: 6.52k, False: 0] ------------------ 561| 6.52k| { 562| 6.52k| png_ptr->jmp_buf_size = 0; /* not allocated */ 563| | 564| 6.52k| if (jmp_buf_size <= (sizeof png_ptr->jmp_buf_local)) ------------------ | Branch (564:11): [True: 6.52k, False: 0] ------------------ 565| 6.52k| png_ptr->jmp_buf_ptr = &png_ptr->jmp_buf_local; 566| | 567| 0| else 568| 0| { 569| 0| png_ptr->jmp_buf_ptr = png_voidcast(jmp_buf *, ------------------ | | 535| 0|# define png_voidcast(type, value) (value) ------------------ 570| 0| png_malloc_warn(png_ptr, jmp_buf_size)); 571| | 572| 0| if (png_ptr->jmp_buf_ptr == NULL) ------------------ | Branch (572:14): [True: 0, False: 0] ------------------ 573| 0| return NULL; /* new NULL return on OOM */ 574| | 575| 0| png_ptr->jmp_buf_size = jmp_buf_size; 576| 0| } 577| 6.52k| } 578| | 579| 0| else /* Already allocated: check the size */ 580| 0| { 581| 0| size_t size = png_ptr->jmp_buf_size; 582| | 583| 0| if (size == 0) ------------------ | Branch (583:11): [True: 0, False: 0] ------------------ 584| 0| { 585| 0| size = (sizeof png_ptr->jmp_buf_local); 586| 0| if (png_ptr->jmp_buf_ptr != &png_ptr->jmp_buf_local) ------------------ | Branch (586:14): [True: 0, False: 0] ------------------ 587| 0| { 588| | /* This is an internal error in libpng: somehow we have been left 589| | * with a stack allocated jmp_buf when the application regained 590| | * control. It's always possible to fix this up, but for the moment 591| | * this is a png_error because that makes it easy to detect. 592| | */ 593| 0| png_error(png_ptr, "Libpng jmp_buf still allocated"); ------------------ | | 252| 0|#define png_error OSS_FUZZ_png_error ------------------ 594| | /* png_ptr->jmp_buf_ptr = &png_ptr->jmp_buf_local; */ 595| 0| } 596| 0| } 597| | 598| 0| if (size != jmp_buf_size) ------------------ | Branch (598:11): [True: 0, False: 0] ------------------ 599| 0| { 600| 0| png_warning(png_ptr, "Application jmp_buf size changed"); ------------------ | | 450| 0|#define png_warning OSS_FUZZ_png_warning ------------------ 601| 0| return NULL; /* caller will probably crash: no choice here */ 602| 0| } 603| 0| } 604| | 605| | /* Finally fill in the function, now we have a satisfactory buffer. It is 606| | * valid to change the function on every call. 607| | */ 608| 6.52k| png_ptr->longjmp_fn = longjmp_fn; 609| 6.52k| return png_ptr->jmp_buf_ptr; 610| 6.52k|} OSS_FUZZ_png_free_jmpbuf: 614| 6.52k|{ 615| 6.52k| if (png_ptr != NULL) ------------------ | Branch (615:8): [True: 6.52k, False: 0] ------------------ 616| 6.52k| { 617| 6.52k| jmp_buf *jb = png_ptr->jmp_buf_ptr; 618| | 619| | /* A size of 0 is used to indicate a local, stack, allocation of the 620| | * pointer; used here and in png.c 621| | */ 622| 6.52k| if (jb != NULL && png_ptr->jmp_buf_size > 0) ------------------ | Branch (622:11): [True: 6.52k, False: 0] | Branch (622:25): [True: 0, False: 6.52k] ------------------ 623| 0| { 624| | 625| | /* This stuff is so that a failure to free the error control structure 626| | * does not leave libpng in a state with no valid error handling: the 627| | * free always succeeds, if there is an error it gets ignored. 628| | */ 629| 0| if (jb != &png_ptr->jmp_buf_local) ------------------ | Branch (629:14): [True: 0, False: 0] ------------------ 630| 0| { 631| | /* Make an internal, libpng, jmp_buf to return here */ 632| 0| jmp_buf free_jmp_buf; 633| | 634| 0| if (!setjmp(free_jmp_buf)) ------------------ | Branch (634:17): [True: 0, False: 0] ------------------ 635| 0| { 636| 0| png_ptr->jmp_buf_ptr = &free_jmp_buf; /* come back here */ 637| 0| png_ptr->jmp_buf_size = 0; /* stack allocation */ 638| 0| png_ptr->longjmp_fn = longjmp; 639| 0| png_free(png_ptr, jb); /* Return to setjmp on error */ ------------------ | | 253| 0|#define png_free OSS_FUZZ_png_free ------------------ 640| 0| } 641| 0| } 642| 0| } 643| | 644| | /* *Always* cancel everything out: */ 645| 6.52k| png_ptr->jmp_buf_size = 0; 646| | png_ptr->jmp_buf_ptr = NULL; 647| 6.52k| png_ptr->longjmp_fn = 0; 648| 6.52k| } 649| 6.52k|} OSS_FUZZ_png_longjmp: 674| 6.46k|{ 675| 6.46k|#ifdef PNG_SETJMP_SUPPORTED 676| 6.46k| if (png_ptr != NULL && png_ptr->longjmp_fn != NULL && ------------------ | Branch (676:8): [True: 6.46k, False: 0] | Branch (676:27): [True: 6.46k, False: 0] ------------------ 677| 6.46k| png_ptr->jmp_buf_ptr != NULL) ------------------ | Branch (677:8): [True: 6.46k, False: 0] ------------------ 678| 6.46k| png_ptr->longjmp_fn(*png_ptr->jmp_buf_ptr, val); 679| |#else 680| | PNG_UNUSED(png_ptr) 681| | PNG_UNUSED(val) 682| |#endif 683| | 684| | /* If control reaches this point, png_longjmp() must not return. The only 685| | * choice is to terminate the whole process (or maybe the thread); to do 686| | * this the ANSI-C abort() function is used unless a different method is 687| | * implemented by overriding the default configuration setting for 688| | * PNG_ABORT(). 689| | */ 690| 6.46k| PNG_ABORT(); ------------------ | | 580| 6.46k|# define PNG_ABORT() abort() ------------------ 691| 6.46k|} OSS_FUZZ_png_set_error_fn: 720| 6.52k|{ 721| 6.52k| if (png_ptr == NULL) ------------------ | Branch (721:8): [True: 0, False: 6.52k] ------------------ 722| 0| return; 723| | 724| 6.52k| png_ptr->error_ptr = error_ptr; 725| 6.52k| png_ptr->error_fn = error_fn; 726| 6.52k|#ifdef PNG_WARNINGS_SUPPORTED 727| 6.52k| png_ptr->warning_fn = warning_fn; 728| |#else 729| | PNG_UNUSED(warning_fn) 730| |#endif 731| 6.52k|} pngerror.c:png_format_buffer: 382| 94.9k|{ 383| 94.9k| png_uint_32 chunk_name = png_ptr->chunk_name; 384| 94.9k| int iout = 0, ishift = 24; 385| | 386| 474k| while (ishift >= 0) ------------------ | Branch (386:11): [True: 379k, False: 94.9k] ------------------ 387| 379k| { 388| 379k| int c = (int)(chunk_name >> ishift) & 0xff; 389| | 390| 379k| ishift -= 8; 391| 379k| if (isnonalpha(c) != 0) ------------------ | | 373| 379k|#define isnonalpha(c) ((c) < 65 || (c) > 122 || ((c) > 90 && (c) < 97)) | | ------------------ | | | Branch (373:24): [True: 309, False: 379k] | | | Branch (373:36): [True: 120, False: 379k] | | | Branch (373:50): [True: 118k, False: 260k] | | | Branch (373:62): [True: 8, False: 118k] | | ------------------ ------------------ | Branch (391:11): [True: 437, False: 379k] ------------------ 392| 437| { 393| 437| buffer[iout++] = PNG_LITERAL_LEFT_SQUARE_BRACKET; ------------------ | | 42| 437|# define PNG_LITERAL_LEFT_SQUARE_BRACKET 0x5b ------------------ 394| 437| buffer[iout++] = png_digit[(c & 0xf0) >> 4]; 395| 437| buffer[iout++] = png_digit[c & 0x0f]; 396| 437| buffer[iout++] = PNG_LITERAL_RIGHT_SQUARE_BRACKET; ------------------ | | 45| 437|# define PNG_LITERAL_RIGHT_SQUARE_BRACKET 0x5d ------------------ 397| 437| } 398| | 399| 379k| else 400| 379k| { 401| 379k| buffer[iout++] = (char)c; 402| 379k| } 403| 379k| } 404| | 405| 94.9k| if (error_message == NULL) ------------------ | Branch (405:8): [True: 0, False: 94.9k] ------------------ 406| 0| buffer[iout] = '\0'; 407| | 408| 94.9k| else 409| 94.9k| { 410| 94.9k| int iin = 0; 411| | 412| 94.9k| buffer[iout++] = ':'; 413| 94.9k| buffer[iout++] = ' '; 414| | 415| 2.30M| while (iin < PNG_MAX_ERROR_TEXT-1 && error_message[iin] != '\0') ------------------ | | 364| 2.30M|#define PNG_MAX_ERROR_TEXT 196 /* Currently limited by profile_error in png.c */ ------------------ | Branch (415:14): [True: 2.30M, False: 0] | Branch (415:44): [True: 2.21M, False: 94.9k] ------------------ 416| 2.21M| buffer[iout++] = error_message[iin++]; 417| | 418| | /* iin < PNG_MAX_ERROR_TEXT, so the following is safe: */ 419| 94.9k| buffer[iout] = '\0'; 420| 94.9k| } 421| 94.9k|} pngerror.c:png_default_error: 660| 6.46k|{ 661| |#ifdef PNG_CONSOLE_IO_SUPPORTED 662| | fprintf(stderr, "libpng error: %s", error_message ? error_message : 663| | "undefined"); 664| | fprintf(stderr, PNG_STRING_NEWLINE); 665| |#else 666| 6.46k| PNG_UNUSED(error_message) /* Make compiler happy */ ------------------ | | 479| 6.46k|# define PNG_UNUSED(param) (void)param; ------------------ 667| 6.46k|#endif 668| 6.46k| png_longjmp(png_ptr, 1); ------------------ | | 346| 12.9k|#define png_longjmp OSS_FUZZ_png_longjmp ------------------ 669| 6.46k|} pngerror.c:png_default_warning: 701| 106k|{ 702| |#ifdef PNG_CONSOLE_IO_SUPPORTED 703| | fprintf(stderr, "libpng warning: %s", warning_message); 704| | fprintf(stderr, PNG_STRING_NEWLINE); 705| |#else 706| 106k| PNG_UNUSED(warning_message) /* Make compiler happy */ ------------------ | | 479| 106k|# define PNG_UNUSED(param) (void)param; ------------------ 707| 106k|#endif 708| 106k| PNG_UNUSED(png_ptr) /* Make compiler happy */ ------------------ | | 479| 106k|# define PNG_UNUSED(param) (void)param; ------------------ 709| 106k|} OSS_FUZZ_png_get_rowbytes: 41| 1.25k|{ 42| 1.25k| if (png_ptr != NULL && info_ptr != NULL) ------------------ | Branch (42:8): [True: 1.25k, False: 0] | Branch (42:27): [True: 1.25k, False: 0] ------------------ 43| 1.25k| return info_ptr->rowbytes; 44| | 45| 0| return 0; 46| 1.25k|} OSS_FUZZ_png_get_image_width: 63| 1.26k|{ 64| 1.26k| if (png_ptr != NULL && info_ptr != NULL) ------------------ | Branch (64:8): [True: 1.26k, False: 0] | Branch (64:27): [True: 1.26k, False: 0] ------------------ 65| 1.26k| return info_ptr->width; 66| | 67| 0| return 0; 68| 1.26k|} OSS_FUZZ_png_get_image_height: 72| 1.26k|{ 73| 1.26k| if (png_ptr != NULL && info_ptr != NULL) ------------------ | Branch (73:8): [True: 1.26k, False: 0] | Branch (73:27): [True: 1.26k, False: 0] ------------------ 74| 1.26k| return info_ptr->height; 75| | 76| 0| return 0; 77| 1.26k|} OSS_FUZZ_png_get_bit_depth: 81| 1.26k|{ 82| 1.26k| if (png_ptr != NULL && info_ptr != NULL) ------------------ | Branch (82:8): [True: 1.26k, False: 0] | Branch (82:27): [True: 1.26k, False: 0] ------------------ 83| 1.26k| return info_ptr->bit_depth; 84| | 85| 0| return 0; 86| 1.26k|} OSS_FUZZ_png_get_color_type: 90| 1.26k|{ 91| 1.26k| if (png_ptr != NULL && info_ptr != NULL) ------------------ | Branch (91:8): [True: 1.26k, False: 0] | Branch (91:27): [True: 1.26k, False: 0] ------------------ 92| 1.26k| return info_ptr->color_type; 93| | 94| 0| return 0; 95| 1.26k|} OSS_FUZZ_png_destroy_png_struct: 25| 6.52k|{ 26| 6.52k| if (png_ptr != NULL) ------------------ | Branch (26:8): [True: 6.52k, False: 0] ------------------ 27| 6.52k| { 28| | /* png_free might call png_error and may certainly call 29| | * png_get_mem_ptr, so fake a temporary png_struct to support this. 30| | */ 31| 6.52k| png_struct dummy_struct = *png_ptr; 32| 6.52k| memset(png_ptr, 0, (sizeof *png_ptr)); 33| 6.52k| png_free(&dummy_struct, png_ptr); ------------------ | | 253| 6.52k|#define png_free OSS_FUZZ_png_free ------------------ 34| | 35| 6.52k|# ifdef PNG_SETJMP_SUPPORTED 36| | /* We may have a jmp_buf left to deallocate. */ 37| 6.52k| png_free_jmpbuf(&dummy_struct); ------------------ | | 13| 6.52k|#define png_free_jmpbuf OSS_FUZZ_png_free_jmpbuf ------------------ 38| 6.52k|# endif 39| 6.52k| } 40| 6.52k|} OSS_FUZZ_png_calloc: 51| 2.25k|{ 52| 2.25k| png_voidp ret; 53| | 54| 2.25k| ret = png_malloc(png_ptr, size); ------------------ | | 347| 2.25k|#define png_malloc OSS_FUZZ_png_malloc ------------------ 55| | 56| 2.25k| if (ret != NULL) ------------------ | Branch (56:8): [True: 2.25k, False: 0] ------------------ 57| 2.25k| memset(ret, 0, size); 58| | 59| 2.25k| return ret; 60| 2.25k|} OSS_FUZZ_png_malloc_base: 70| 58.3k|{ 71| | /* Moved to png_malloc_base from png_malloc_default in 1.6.0; the DOS 72| | * allocators have also been removed in 1.6.0, so any 16-bit system now has 73| | * to implement a user memory handler. This checks to be sure it isn't 74| | * called with big numbers. 75| | */ 76| |# ifdef PNG_MAX_MALLOC_64K 77| | /* This is support for legacy systems which had segmented addressing 78| | * limiting the maximum allocation size to 65536. It takes precedence 79| | * over PNG_SIZE_MAX which is set to 65535 on true 16-bit systems. 80| | * 81| | * TODO: libpng-1.8: finally remove both cases. 82| | */ 83| | if (size > 65536U) return NULL; 84| |# endif 85| | 86| | /* This is checked too because the system malloc call below takes a (size_t). 87| | */ 88| 58.3k| if (size > PNG_SIZE_MAX) return NULL; ------------------ | | 649| 58.3k|#define PNG_SIZE_MAX ((size_t)(-1)) ------------------ | Branch (88:8): [True: 0, False: 58.3k] ------------------ 89| | 90| 58.3k|# ifdef PNG_USER_MEM_SUPPORTED 91| 58.3k| if (png_ptr != NULL && png_ptr->malloc_fn != NULL) ------------------ | Branch (91:11): [True: 58.3k, False: 0] | Branch (91:30): [True: 0, False: 58.3k] ------------------ 92| 0| return png_ptr->malloc_fn(png_constcast(png_structrp,png_ptr), size); ------------------ | | 536| 0|# define png_constcast(type, value) ((type)(void*)(const void*)(value)) ------------------ 93| |# else 94| | PNG_UNUSED(png_ptr) 95| |# endif 96| | 97| | /* Use the system malloc */ 98| 58.3k| return malloc((size_t)/*SAFE*/size); /* checked for truncation above */ 99| 58.3k|} OSS_FUZZ_png_malloc_array: 124| 1.17k|{ 125| 1.17k| if (nelements <= 0 || element_size == 0) ------------------ | Branch (125:8): [True: 0, False: 1.17k] | Branch (125:26): [True: 0, False: 1.17k] ------------------ 126| 0| png_error(png_ptr, "internal error: array alloc"); ------------------ | | 252| 0|#define png_error OSS_FUZZ_png_error ------------------ 127| | 128| 1.17k| return png_malloc_array_checked(png_ptr, nelements, element_size); 129| 1.17k|} OSS_FUZZ_png_realloc_array: 135| 2.85k|{ 136| | /* These are internal errors: */ 137| 2.85k| if (add_elements <= 0 || element_size == 0 || old_elements < 0 || ------------------ | Branch (137:8): [True: 0, False: 2.85k] | Branch (137:29): [True: 0, False: 2.85k] | Branch (137:50): [True: 0, False: 2.85k] ------------------ 138| 2.85k| (old_array == NULL && old_elements > 0)) ------------------ | Branch (138:8): [True: 214, False: 2.63k] | Branch (138:29): [True: 0, False: 214] ------------------ 139| 0| png_error(png_ptr, "internal error: array realloc"); ------------------ | | 252| 0|#define png_error OSS_FUZZ_png_error ------------------ 140| | 141| | /* Check for overflow on the elements count (so the caller does not have to 142| | * check.) 143| | */ 144| 2.85k| if (add_elements <= INT_MAX - old_elements) ------------------ | Branch (144:8): [True: 2.85k, False: 0] ------------------ 145| 2.85k| { 146| 2.85k| png_voidp new_array = png_malloc_array_checked(png_ptr, 147| 2.85k| old_elements+add_elements, element_size); 148| | 149| 2.85k| if (new_array != NULL) ------------------ | Branch (149:11): [True: 2.85k, False: 0] ------------------ 150| 2.85k| { 151| | /* Because png_malloc_array worked the size calculations below cannot 152| | * overflow. 153| | */ 154| 2.85k| if (old_elements > 0) ------------------ | Branch (154:14): [True: 2.63k, False: 214] ------------------ 155| 2.63k| memcpy(new_array, old_array, element_size*(unsigned)old_elements); 156| | 157| 2.85k| memset((char*)new_array + element_size*(unsigned)old_elements, 0, 158| 2.85k| element_size*(unsigned)add_elements); 159| | 160| 2.85k| return new_array; 161| 2.85k| } 162| 2.85k| } 163| | 164| 0| return NULL; /* error */ 165| 2.85k|} OSS_FUZZ_png_malloc: 175| 10.7k|{ 176| 10.7k| png_voidp ret; 177| | 178| 10.7k| if (png_ptr == NULL) ------------------ | Branch (178:8): [True: 0, False: 10.7k] ------------------ 179| 0| return NULL; 180| | 181| 10.7k| ret = png_malloc_base(png_ptr, size); ------------------ | | 8| 10.7k|#define png_malloc_base OSS_FUZZ_png_malloc_base ------------------ 182| | 183| 10.7k| if (ret == NULL) ------------------ | Branch (183:8): [True: 0, False: 10.7k] ------------------ 184| 0| png_error(png_ptr, "Out of memory"); /* 'm' means png_malloc */ ------------------ | | 252| 0|#define png_error OSS_FUZZ_png_error ------------------ 185| | 186| 10.7k| return ret; 187| 10.7k|} OSS_FUZZ_png_malloc_warn: 216| 19.6k|{ 217| 19.6k| if (png_ptr != NULL) ------------------ | Branch (217:8): [True: 19.6k, False: 0] ------------------ 218| 19.6k| { 219| 19.6k| png_voidp ret = png_malloc_base(png_ptr, size); ------------------ | | 8| 19.6k|#define png_malloc_base OSS_FUZZ_png_malloc_base ------------------ 220| | 221| 19.6k| if (ret != NULL) ------------------ | Branch (221:11): [True: 19.6k, False: 0] ------------------ 222| 19.6k| return ret; 223| | 224| 0| png_warning(png_ptr, "Out of memory"); ------------------ | | 450| 0|#define png_warning OSS_FUZZ_png_warning ------------------ 225| 0| } 226| | 227| 0| return NULL; 228| 19.6k|} OSS_FUZZ_png_free: 235| 156k|{ 236| 156k| if (png_ptr == NULL || ptr == NULL) ------------------ | Branch (236:8): [True: 0, False: 156k] | Branch (236:27): [True: 98.5k, False: 58.3k] ------------------ 237| 98.5k| return; 238| | 239| 58.3k|#ifdef PNG_USER_MEM_SUPPORTED 240| 58.3k| if (png_ptr->free_fn != NULL) ------------------ | Branch (240:8): [True: 0, False: 58.3k] ------------------ 241| 0| png_ptr->free_fn(png_constcast(png_structrp,png_ptr), ptr); ------------------ | | 536| 0|# define png_constcast(type, value) ((type)(void*)(const void*)(value)) ------------------ 242| | 243| 58.3k| else 244| 58.3k| png_free_default(png_ptr, ptr); ------------------ | | 255| 58.3k|#define png_free_default OSS_FUZZ_png_free_default ------------------ 245| 58.3k|} OSS_FUZZ_png_free_default: 250| 58.3k|{ 251| 58.3k| if (png_ptr == NULL || ptr == NULL) ------------------ | Branch (251:8): [True: 0, False: 58.3k] | Branch (251:27): [True: 0, False: 58.3k] ------------------ 252| 0| return; 253| 58.3k|#endif /* USER_MEM */ 254| | 255| 58.3k| free(ptr); 256| 58.3k|} OSS_FUZZ_png_set_mem_fn: 265| 6.52k|{ 266| 6.52k| if (png_ptr != NULL) ------------------ | Branch (266:8): [True: 6.52k, False: 0] ------------------ 267| 6.52k| { 268| 6.52k| png_ptr->mem_ptr = mem_ptr; 269| 6.52k| png_ptr->malloc_fn = malloc_fn; 270| 6.52k| png_ptr->free_fn = free_fn; 271| 6.52k| } 272| 6.52k|} pngmem.c:png_malloc_array_checked: 110| 4.02k|{ 111| 4.02k| png_alloc_size_t req = (png_alloc_size_t)nelements; /* known to be > 0 */ 112| | 113| 4.02k| if (req <= PNG_SIZE_MAX/element_size) ------------------ | | 649| 4.02k|#define PNG_SIZE_MAX ((size_t)(-1)) ------------------ | Branch (113:8): [True: 4.02k, False: 0] ------------------ 114| 4.02k| return png_malloc_base(png_ptr, req * element_size); ------------------ | | 8| 4.02k|#define png_malloc_base OSS_FUZZ_png_malloc_base ------------------ 115| | 116| | /* The failure case when the request is too large */ 117| 0| return NULL; 118| 4.02k|} OSS_FUZZ_png_create_read_struct: 28| 6.52k|{ 29| |#ifndef PNG_USER_MEM_SUPPORTED 30| | png_structp png_ptr = png_create_png_struct(user_png_ver, error_ptr, 31| | error_fn, warn_fn, NULL, NULL, NULL); 32| |#else 33| 6.52k| return png_create_read_struct_2(user_png_ver, error_ptr, error_fn, ------------------ | | 245| 6.52k|#define png_create_read_struct_2 OSS_FUZZ_png_create_read_struct_2 ------------------ 34| 6.52k| warn_fn, NULL, NULL, NULL); 35| 6.52k|} OSS_FUZZ_png_create_read_struct_2: 45| 6.52k|{ 46| 6.52k| png_structp png_ptr = png_create_png_struct(user_png_ver, error_ptr, ------------------ | | 11| 6.52k|#define png_create_png_struct OSS_FUZZ_png_create_png_struct ------------------ 47| 6.52k| error_fn, warn_fn, mem_ptr, malloc_fn, free_fn); 48| 6.52k|#endif /* USER_MEM */ 49| | 50| 6.52k| if (png_ptr != NULL) ------------------ | Branch (50:8): [True: 6.52k, False: 0] ------------------ 51| 6.52k| { 52| 6.52k| png_ptr->mode = PNG_IS_READ_STRUCT; ------------------ | | 655| 6.52k|#define PNG_IS_READ_STRUCT 0x8000U /* Else is a write struct */ ------------------ 53| | 54| | /* Added in libpng-1.6.0; this can be used to detect a read structure if 55| | * required (it will be zero in a write structure.) 56| | */ 57| 6.52k|# ifdef PNG_SEQUENTIAL_READ_SUPPORTED 58| 6.52k| png_ptr->IDAT_read_size = PNG_IDAT_READ_SIZE; ------------------ | | 209| 6.52k|#define PNG_IDAT_READ_SIZE PNG_ZBUF_SIZE | | ------------------ | | | | 226| 6.52k|#define PNG_ZBUF_SIZE 8192 | | ------------------ ------------------ 59| 6.52k|# endif 60| | 61| 6.52k|# ifdef PNG_BENIGN_READ_ERRORS_SUPPORTED 62| 6.52k| png_ptr->flags |= PNG_FLAG_BENIGN_ERRORS_WARN; ------------------ | | 715| 6.52k|#define PNG_FLAG_BENIGN_ERRORS_WARN 0x100000U /* Added to libpng-1.4.0 */ ------------------ 63| | 64| | /* In stable builds only warn if an application error can be completely 65| | * handled. 66| | */ 67| |# if PNG_RELEASE_BUILD 68| | png_ptr->flags |= PNG_FLAG_APP_WARNINGS_WARN; 69| |# endif 70| 6.52k|# endif 71| | 72| | /* TODO: delay this, it can be done in png_init_io (if the app doesn't 73| | * do it itself) avoiding setting the default function if it is not 74| | * required. 75| | */ 76| 6.52k| png_set_read_fn(png_ptr, NULL, NULL); ------------------ | | 417| 6.52k|#define png_set_read_fn OSS_FUZZ_png_set_read_fn ------------------ 77| 6.52k| } 78| | 79| 6.52k| return png_ptr; 80| 6.52k|} OSS_FUZZ_png_read_info: 94| 6.52k|{ 95| 6.52k|#ifdef PNG_HANDLE_AS_UNKNOWN_SUPPORTED 96| 6.52k| int keep; 97| 6.52k|#endif 98| | 99| 6.52k| png_debug(1, "in png_read_info"); ------------------ | | 145| 6.52k|# define png_debug(l, m) ((void)0) ------------------ 100| | 101| 6.52k| if (png_ptr == NULL || info_ptr == NULL) ------------------ | Branch (101:8): [True: 0, False: 6.52k] | Branch (101:27): [True: 0, False: 6.52k] ------------------ 102| 0| return; 103| | 104| | /* Read and check the PNG file signature. */ 105| 6.52k| png_read_sig(png_ptr, info_ptr); ------------------ | | 21| 6.52k|#define png_read_sig OSS_FUZZ_png_read_sig ------------------ 106| | 107| 6.52k| for (;;) 108| 99.0k| { 109| 99.0k| png_uint_32 length = png_read_chunk_header(png_ptr); ------------------ | | 22| 99.0k|#define png_read_chunk_header OSS_FUZZ_png_read_chunk_header ------------------ 110| 99.0k| png_uint_32 chunk_name = png_ptr->chunk_name; 111| | 112| | /* IDAT logic needs to happen here to simplify getting the two flags 113| | * right. 114| | */ 115| 99.0k| if (chunk_name == png_IDAT) ------------------ | | 886| 99.0k|#define png_IDAT PNG_U32( 73, 68, 65, 84) | | ------------------ | | | | 845| 99.0k| (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0)) | | | | ------------------ | | | | | | 843| 99.0k|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s)) | | | | ------------------ | | | | (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0)) | | | | ------------------ | | | | | | 843| 99.0k|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s)) | | | | ------------------ | | | | (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0)) | | | | ------------------ | | | | | | 843| 99.0k|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s)) | | | | ------------------ | | | | (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0)) | | | | ------------------ | | | | | | 843| 99.0k|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s)) | | | | ------------------ | | ------------------ ------------------ | Branch (115:11): [True: 1.26k, False: 97.7k] ------------------ 116| 1.26k| { 117| 1.26k| if ((png_ptr->mode & PNG_HAVE_IHDR) == 0) ------------------ | | 642| 1.26k|#define PNG_HAVE_IHDR 0x01 ------------------ | Branch (117:14): [True: 1, False: 1.26k] ------------------ 118| 1| png_chunk_error(png_ptr, "Missing IHDR before IDAT"); ------------------ | | 239| 1|#define png_chunk_error OSS_FUZZ_png_chunk_error ------------------ 119| | 120| 1.26k| else if (png_ptr->color_type == PNG_COLOR_TYPE_PALETTE && ------------------ | | 667| 2.53k|#define PNG_COLOR_TYPE_PALETTE (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_PALETTE) | | ------------------ | | | | 662| 1.26k|#define PNG_COLOR_MASK_COLOR 2 | | ------------------ | | #define PNG_COLOR_TYPE_PALETTE (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_PALETTE) | | ------------------ | | | | 661| 1.26k|#define PNG_COLOR_MASK_PALETTE 1 | | ------------------ ------------------ | Branch (120:19): [True: 76, False: 1.19k] ------------------ 121| 76| (png_ptr->mode & PNG_HAVE_PLTE) == 0) ------------------ | | 643| 76|#define PNG_HAVE_PLTE 0x02 ------------------ | Branch (121:14): [True: 1, False: 75] ------------------ 122| 1| png_chunk_error(png_ptr, "Missing PLTE before IDAT"); ------------------ | | 239| 1|#define png_chunk_error OSS_FUZZ_png_chunk_error ------------------ 123| | 124| 1.26k| else if ((png_ptr->mode & PNG_AFTER_IDAT) != 0) ------------------ | | 644| 1.26k|#define PNG_AFTER_IDAT 0x08 ------------------ | Branch (124:19): [True: 0, False: 1.26k] ------------------ 125| 0| png_chunk_benign_error(png_ptr, "Too many IDATs found"); ------------------ | | 238| 0|#define png_chunk_benign_error OSS_FUZZ_png_chunk_benign_error ------------------ 126| | 127| 1.26k| png_ptr->mode |= PNG_HAVE_IDAT; ------------------ | | 642| 1.26k|#define PNG_HAVE_IDAT 0x04U ------------------ 128| 1.26k| } 129| | 130| 97.7k| else if ((png_ptr->mode & PNG_HAVE_IDAT) != 0) ------------------ | | 642| 97.7k|#define PNG_HAVE_IDAT 0x04U ------------------ | Branch (130:16): [True: 0, False: 97.7k] ------------------ 131| 0| { 132| 0| png_ptr->mode |= PNG_HAVE_CHUNK_AFTER_IDAT; ------------------ | | 653| 0|#define PNG_HAVE_CHUNK_AFTER_IDAT 0x2000U /* Have another chunk after IDAT */ ------------------ 133| 0| png_ptr->mode |= PNG_AFTER_IDAT; ------------------ | | 644| 0|#define PNG_AFTER_IDAT 0x08 ------------------ 134| 0| } 135| | 136| 99.0k| if (chunk_name == png_IHDR) ------------------ | | 888| 99.0k|#define png_IHDR PNG_U32( 73, 72, 68, 82) | | ------------------ | | | | 845| 99.0k| (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0)) | | | | ------------------ | | | | | | 843| 99.0k|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s)) | | | | ------------------ | | | | (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0)) | | | | ------------------ | | | | | | 843| 99.0k|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s)) | | | | ------------------ | | | | (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0)) | | | | ------------------ | | | | | | 843| 99.0k|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s)) | | | | ------------------ | | | | (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0)) | | | | ------------------ | | | | | | 843| 99.0k|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s)) | | | | ------------------ | | ------------------ ------------------ | Branch (136:11): [True: 5.36k, False: 93.6k] ------------------ 137| 5.36k| png_handle_chunk(png_ptr, info_ptr, length); ------------------ | | 50| 5.36k|#define png_handle_chunk OSS_FUZZ_png_handle_chunk ------------------ 138| | 139| 93.6k| else if (chunk_name == png_IEND) ------------------ | | 887| 93.6k|#define png_IEND PNG_U32( 73, 69, 78, 68) | | ------------------ | | | | 845| 93.6k| (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0)) | | | | ------------------ | | | | | | 843| 93.6k|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s)) | | | | ------------------ | | | | (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0)) | | | | ------------------ | | | | | | 843| 93.6k|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s)) | | | | ------------------ | | | | (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0)) | | | | ------------------ | | | | | | 843| 93.6k|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s)) | | | | ------------------ | | | | (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0)) | | | | ------------------ | | | | | | 843| 93.6k|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s)) | | | | ------------------ | | ------------------ ------------------ | Branch (139:16): [True: 2, False: 93.6k] ------------------ 140| 2| png_handle_chunk(png_ptr, info_ptr, length); ------------------ | | 50| 2|#define png_handle_chunk OSS_FUZZ_png_handle_chunk ------------------ 141| | 142| 93.6k|#ifdef PNG_HANDLE_AS_UNKNOWN_SUPPORTED 143| 93.6k| else if ((keep = png_chunk_unknown_handling(png_ptr, chunk_name)) != 0) ------------------ | | 51| 93.6k|#define png_chunk_unknown_handling OSS_FUZZ_png_chunk_unknown_handling ------------------ | Branch (143:16): [True: 0, False: 93.6k] ------------------ 144| 0| { 145| 0| png_handle_unknown(png_ptr, info_ptr, length, keep); ------------------ | | 49| 0|#define png_handle_unknown OSS_FUZZ_png_handle_unknown ------------------ 146| | 147| 0| if (chunk_name == png_PLTE) ------------------ | | 889| 0|#define png_PLTE PNG_U32( 80, 76, 84, 69) | | ------------------ | | | | 845| 0| (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0)) | | | | ------------------ | | | | | | 843| 0|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s)) | | | | ------------------ | | | | (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0)) | | | | ------------------ | | | | | | 843| 0|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s)) | | | | ------------------ | | | | (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0)) | | | | ------------------ | | | | | | 843| 0|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s)) | | | | ------------------ | | | | (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0)) | | | | ------------------ | | | | | | 843| 0|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s)) | | | | ------------------ | | ------------------ ------------------ | Branch (147:14): [True: 0, False: 0] ------------------ 148| 0| png_ptr->mode |= PNG_HAVE_PLTE; ------------------ | | 643| 0|#define PNG_HAVE_PLTE 0x02 ------------------ 149| | 150| 0| else if (chunk_name == png_IDAT) ------------------ | | 886| 0|#define png_IDAT PNG_U32( 73, 68, 65, 84) | | ------------------ | | | | 845| 0| (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0)) | | | | ------------------ | | | | | | 843| 0|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s)) | | | | ------------------ | | | | (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0)) | | | | ------------------ | | | | | | 843| 0|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s)) | | | | ------------------ | | | | (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0)) | | | | ------------------ | | | | | | 843| 0|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s)) | | | | ------------------ | | | | (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0)) | | | | ------------------ | | | | | | 843| 0|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s)) | | | | ------------------ | | ------------------ ------------------ | Branch (150:19): [True: 0, False: 0] ------------------ 151| 0| { 152| 0| png_ptr->idat_size = 0; /* It has been consumed */ 153| 0| break; 154| 0| } 155| 0| } 156| 93.6k|#endif 157| | 158| 93.6k| else if (chunk_name == png_IDAT) ------------------ | | 886| 93.6k|#define png_IDAT PNG_U32( 73, 68, 65, 84) | | ------------------ | | | | 845| 93.6k| (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0)) | | | | ------------------ | | | | | | 843| 93.6k|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s)) | | | | ------------------ | | | | (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0)) | | | | ------------------ | | | | | | 843| 93.6k|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s)) | | | | ------------------ | | | | (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0)) | | | | ------------------ | | | | | | 843| 93.6k|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s)) | | | | ------------------ | | | | (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0)) | | | | ------------------ | | | | | | 843| 93.6k|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s)) | | | | ------------------ | | ------------------ ------------------ | Branch (158:16): [True: 1.26k, False: 92.4k] ------------------ 159| 1.26k| { 160| 1.26k| png_ptr->idat_size = length; 161| 1.26k| break; 162| 1.26k| } 163| | 164| 92.4k| else 165| 92.4k| png_handle_chunk(png_ptr, info_ptr, length); ------------------ | | 50| 92.4k|#define png_handle_chunk OSS_FUZZ_png_handle_chunk ------------------ 166| 99.0k| } 167| 6.52k|} OSS_FUZZ_png_read_update_info: 173| 1.25k|{ 174| 1.25k| png_debug(1, "in png_read_update_info"); ------------------ | | 145| 1.25k|# define png_debug(l, m) ((void)0) ------------------ 175| | 176| 1.25k| if (png_ptr != NULL) ------------------ | Branch (176:8): [True: 1.25k, False: 0] ------------------ 177| 1.25k| { 178| 1.25k| if ((png_ptr->flags & PNG_FLAG_ROW_INIT) == 0) ------------------ | | 701| 1.25k|#define PNG_FLAG_ROW_INIT 0x0040U ------------------ | Branch (178:11): [True: 1.25k, False: 0] ------------------ 179| 1.25k| { 180| 1.25k| png_read_start_row(png_ptr); ------------------ | | 41| 1.25k|#define png_read_start_row OSS_FUZZ_png_read_start_row ------------------ 181| | 182| 1.25k|# ifdef PNG_READ_TRANSFORMS_SUPPORTED 183| 1.25k| png_read_transform_info(png_ptr, info_ptr); ------------------ | | 43| 1.25k|#define png_read_transform_info OSS_FUZZ_png_read_transform_info ------------------ 184| |# else 185| | PNG_UNUSED(info_ptr) 186| |# endif 187| 1.25k| } 188| | 189| | /* New in 1.6.0 this avoids the bug of doing the initializations twice */ 190| 0| else 191| 0| png_app_error(png_ptr, ------------------ | | 82| 0|#define png_app_error OSS_FUZZ_png_app_error ------------------ 192| 0| "png_read_update_info/png_start_read_image: duplicate call"); 193| 1.25k| } 194| 1.25k|} OSS_FUZZ_png_read_row: 289| 10.9k|{ 290| 10.9k| png_row_info row_info; 291| | 292| 10.9k| if (png_ptr == NULL) ------------------ | Branch (292:8): [True: 0, False: 10.9k] ------------------ 293| 0| return; 294| | 295| 10.9k| png_debug2(1, "in png_read_row (row %lu, pass %d)", ------------------ | | 151| 10.9k|# define png_debug2(l, m, p1, p2) ((void)0) ------------------ 296| 10.9k| (unsigned long)png_ptr->row_number, png_ptr->pass); 297| | 298| | /* png_read_start_row sets the information (in particular iwidth) for this 299| | * interlace pass. 300| | */ 301| 10.9k| if ((png_ptr->flags & PNG_FLAG_ROW_INIT) == 0) ------------------ | | 701| 10.9k|#define PNG_FLAG_ROW_INIT 0x0040U ------------------ | Branch (301:8): [True: 0, False: 10.9k] ------------------ 302| 0| png_read_start_row(png_ptr); ------------------ | | 41| 0|#define png_read_start_row OSS_FUZZ_png_read_start_row ------------------ 303| | 304| | /* 1.5.6: row_info moved out of png_struct to a local here. */ 305| 10.9k| row_info.width = png_ptr->iwidth; /* NOTE: width of current interlaced row */ 306| 10.9k| row_info.color_type = png_ptr->color_type; 307| 10.9k| row_info.bit_depth = png_ptr->bit_depth; 308| 10.9k| row_info.channels = png_ptr->channels; 309| 10.9k| row_info.pixel_depth = png_ptr->pixel_depth; 310| 10.9k| row_info.rowbytes = PNG_ROWBYTES(row_info.pixel_depth, row_info.width); ------------------ | | 755| 10.9k| ((pixel_bits) >= 8 ? \ | | ------------------ | | | Branch (755:6): [True: 7.52k, False: 3.38k] | | ------------------ | | 756| 10.9k| ((size_t)(width) * (((size_t)(pixel_bits)) >> 3)) : \ | | 757| 10.9k| (( ((size_t)(width) * ((size_t)(pixel_bits))) + 7) >> 3) ) ------------------ 311| | 312| 10.9k|#ifdef PNG_WARNINGS_SUPPORTED 313| 10.9k| if (png_ptr->row_number == 0 && png_ptr->pass == 0) ------------------ | Branch (313:8): [True: 2.28k, False: 8.63k] | Branch (313:36): [True: 1.25k, False: 1.03k] ------------------ 314| 1.25k| { 315| | /* Check for transforms that have been set but were defined out */ 316| |#if defined(PNG_WRITE_INVERT_SUPPORTED) && !defined(PNG_READ_INVERT_SUPPORTED) 317| | if ((png_ptr->transformations & PNG_INVERT_MONO) != 0) 318| | png_warning(png_ptr, "PNG_READ_INVERT_SUPPORTED is not defined"); 319| |#endif 320| | 321| |#if defined(PNG_WRITE_FILLER_SUPPORTED) && !defined(PNG_READ_FILLER_SUPPORTED) 322| | if ((png_ptr->transformations & PNG_FILLER) != 0) 323| | png_warning(png_ptr, "PNG_READ_FILLER_SUPPORTED is not defined"); 324| |#endif 325| | 326| |#if defined(PNG_WRITE_PACKSWAP_SUPPORTED) && \ 327| | !defined(PNG_READ_PACKSWAP_SUPPORTED) 328| | if ((png_ptr->transformations & PNG_PACKSWAP) != 0) 329| | png_warning(png_ptr, "PNG_READ_PACKSWAP_SUPPORTED is not defined"); 330| |#endif 331| | 332| |#if defined(PNG_WRITE_PACK_SUPPORTED) && !defined(PNG_READ_PACK_SUPPORTED) 333| | if ((png_ptr->transformations & PNG_PACK) != 0) 334| | png_warning(png_ptr, "PNG_READ_PACK_SUPPORTED is not defined"); 335| |#endif 336| | 337| |#if defined(PNG_WRITE_SHIFT_SUPPORTED) && !defined(PNG_READ_SHIFT_SUPPORTED) 338| | if ((png_ptr->transformations & PNG_SHIFT) != 0) 339| | png_warning(png_ptr, "PNG_READ_SHIFT_SUPPORTED is not defined"); 340| |#endif 341| | 342| |#if defined(PNG_WRITE_BGR_SUPPORTED) && !defined(PNG_READ_BGR_SUPPORTED) 343| | if ((png_ptr->transformations & PNG_BGR) != 0) 344| | png_warning(png_ptr, "PNG_READ_BGR_SUPPORTED is not defined"); 345| |#endif 346| | 347| |#if defined(PNG_WRITE_SWAP_SUPPORTED) && !defined(PNG_READ_SWAP_SUPPORTED) 348| | if ((png_ptr->transformations & PNG_SWAP_BYTES) != 0) 349| | png_warning(png_ptr, "PNG_READ_SWAP_SUPPORTED is not defined"); 350| |#endif 351| 1.25k| } 352| 10.9k|#endif /* WARNINGS */ 353| | 354| 10.9k|#ifdef PNG_READ_INTERLACING_SUPPORTED 355| | /* If interlaced and we do not need a new row, combine row and return. 356| | * Notice that the pixels we have from previous rows have been transformed 357| | * already; we can only combine like with like (transformed or 358| | * untransformed) and, because of the libpng API for interlaced images, this 359| | * means we must transform before de-interlacing. 360| | */ 361| 10.9k| if (png_ptr->interlaced != 0 && ------------------ | Branch (361:8): [True: 7.74k, False: 3.16k] ------------------ 362| 7.74k| (png_ptr->transformations & PNG_INTERLACE) != 0) ------------------ | | 659| 7.74k|#define PNG_INTERLACE 0x0002U ------------------ | Branch (362:8): [True: 0, False: 7.74k] ------------------ 363| 0| { 364| 0| switch (png_ptr->pass) 365| 0| { 366| 0| case 0: ------------------ | Branch (366:10): [True: 0, False: 0] ------------------ 367| 0| if (png_ptr->row_number & 0x07) ------------------ | Branch (367:17): [True: 0, False: 0] ------------------ 368| 0| { 369| 0| if (dsp_row != NULL) ------------------ | Branch (369:20): [True: 0, False: 0] ------------------ 370| 0| png_combine_row(png_ptr, dsp_row, 1/*display*/); ------------------ | | 34| 0|#define png_combine_row OSS_FUZZ_png_combine_row ------------------ 371| 0| png_read_finish_row(png_ptr); ------------------ | | 40| 0|#define png_read_finish_row OSS_FUZZ_png_read_finish_row ------------------ 372| 0| return; 373| 0| } 374| 0| break; 375| | 376| 0| case 1: ------------------ | Branch (376:10): [True: 0, False: 0] ------------------ 377| 0| if ((png_ptr->row_number & 0x07) || png_ptr->width < 5) ------------------ | Branch (377:17): [True: 0, False: 0] | Branch (377:49): [True: 0, False: 0] ------------------ 378| 0| { 379| 0| if (dsp_row != NULL) ------------------ | Branch (379:20): [True: 0, False: 0] ------------------ 380| 0| png_combine_row(png_ptr, dsp_row, 1/*display*/); ------------------ | | 34| 0|#define png_combine_row OSS_FUZZ_png_combine_row ------------------ 381| | 382| 0| png_read_finish_row(png_ptr); ------------------ | | 40| 0|#define png_read_finish_row OSS_FUZZ_png_read_finish_row ------------------ 383| 0| return; 384| 0| } 385| 0| break; 386| | 387| 0| case 2: ------------------ | Branch (387:10): [True: 0, False: 0] ------------------ 388| 0| if ((png_ptr->row_number & 0x07) != 4) ------------------ | Branch (388:17): [True: 0, False: 0] ------------------ 389| 0| { 390| 0| if (dsp_row != NULL && (png_ptr->row_number & 4)) ------------------ | Branch (390:20): [True: 0, False: 0] | Branch (390:39): [True: 0, False: 0] ------------------ 391| 0| png_combine_row(png_ptr, dsp_row, 1/*display*/); ------------------ | | 34| 0|#define png_combine_row OSS_FUZZ_png_combine_row ------------------ 392| | 393| 0| png_read_finish_row(png_ptr); ------------------ | | 40| 0|#define png_read_finish_row OSS_FUZZ_png_read_finish_row ------------------ 394| 0| return; 395| 0| } 396| 0| break; 397| | 398| 0| case 3: ------------------ | Branch (398:10): [True: 0, False: 0] ------------------ 399| 0| if ((png_ptr->row_number & 3) || png_ptr->width < 3) ------------------ | Branch (399:17): [True: 0, False: 0] | Branch (399:46): [True: 0, False: 0] ------------------ 400| 0| { 401| 0| if (dsp_row != NULL) ------------------ | Branch (401:20): [True: 0, False: 0] ------------------ 402| 0| png_combine_row(png_ptr, dsp_row, 1/*display*/); ------------------ | | 34| 0|#define png_combine_row OSS_FUZZ_png_combine_row ------------------ 403| | 404| 0| png_read_finish_row(png_ptr); ------------------ | | 40| 0|#define png_read_finish_row OSS_FUZZ_png_read_finish_row ------------------ 405| 0| return; 406| 0| } 407| 0| break; 408| | 409| 0| case 4: ------------------ | Branch (409:10): [True: 0, False: 0] ------------------ 410| 0| if ((png_ptr->row_number & 3) != 2) ------------------ | Branch (410:17): [True: 0, False: 0] ------------------ 411| 0| { 412| 0| if (dsp_row != NULL && (png_ptr->row_number & 2)) ------------------ | Branch (412:20): [True: 0, False: 0] | Branch (412:39): [True: 0, False: 0] ------------------ 413| 0| png_combine_row(png_ptr, dsp_row, 1/*display*/); ------------------ | | 34| 0|#define png_combine_row OSS_FUZZ_png_combine_row ------------------ 414| | 415| 0| png_read_finish_row(png_ptr); ------------------ | | 40| 0|#define png_read_finish_row OSS_FUZZ_png_read_finish_row ------------------ 416| 0| return; 417| 0| } 418| 0| break; 419| | 420| 0| case 5: ------------------ | Branch (420:10): [True: 0, False: 0] ------------------ 421| 0| if ((png_ptr->row_number & 1) || png_ptr->width < 2) ------------------ | Branch (421:17): [True: 0, False: 0] | Branch (421:46): [True: 0, False: 0] ------------------ 422| 0| { 423| 0| if (dsp_row != NULL) ------------------ | Branch (423:20): [True: 0, False: 0] ------------------ 424| 0| png_combine_row(png_ptr, dsp_row, 1/*display*/); ------------------ | | 34| 0|#define png_combine_row OSS_FUZZ_png_combine_row ------------------ 425| | 426| 0| png_read_finish_row(png_ptr); ------------------ | | 40| 0|#define png_read_finish_row OSS_FUZZ_png_read_finish_row ------------------ 427| 0| return; 428| 0| } 429| 0| break; 430| | 431| 0| default: ------------------ | Branch (431:10): [True: 0, False: 0] ------------------ 432| 0| case 6: ------------------ | Branch (432:10): [True: 0, False: 0] ------------------ 433| 0| if ((png_ptr->row_number & 1) == 0) ------------------ | Branch (433:17): [True: 0, False: 0] ------------------ 434| 0| { 435| 0| png_read_finish_row(png_ptr); ------------------ | | 40| 0|#define png_read_finish_row OSS_FUZZ_png_read_finish_row ------------------ 436| 0| return; 437| 0| } 438| 0| break; 439| 0| } 440| 0| } 441| 10.9k|#endif 442| | 443| 10.9k| if ((png_ptr->mode & PNG_HAVE_IDAT) == 0) ------------------ | | 642| 10.9k|#define PNG_HAVE_IDAT 0x04U ------------------ | Branch (443:8): [True: 0, False: 10.9k] ------------------ 444| 0| png_error(png_ptr, "Invalid attempt to read row data"); ------------------ | | 252| 0|#define png_error OSS_FUZZ_png_error ------------------ 445| | 446| | /* Fill the row with IDAT data: */ 447| 10.9k| png_ptr->row_buf[0]=255; /* to force error if no data was found */ 448| 10.9k| png_read_IDAT_data(png_ptr, png_ptr->row_buf, row_info.rowbytes + 1); ------------------ | | 38| 10.9k|#define png_read_IDAT_data OSS_FUZZ_png_read_IDAT_data ------------------ 449| | 450| 10.9k| if (png_ptr->row_buf[0] > PNG_FILTER_VALUE_NONE) ------------------ | | 1541| 10.9k|#define PNG_FILTER_VALUE_NONE 0 ------------------ | Branch (450:8): [True: 6.88k, False: 4.03k] ------------------ 451| 6.88k| { 452| 6.88k| if (png_ptr->row_buf[0] < PNG_FILTER_VALUE_LAST) ------------------ | | 1546| 6.88k|#define PNG_FILTER_VALUE_LAST 5 ------------------ | Branch (452:11): [True: 6.80k, False: 79] ------------------ 453| 6.80k| png_read_filter_row(png_ptr, &row_info, png_ptr->row_buf + 1, ------------------ | | 36| 6.80k|#define png_read_filter_row OSS_FUZZ_png_read_filter_row ------------------ 454| 6.80k| png_ptr->prev_row + 1, png_ptr->row_buf[0]); 455| 79| else 456| 79| png_error(png_ptr, "bad adaptive filter value"); ------------------ | | 252| 79|#define png_error OSS_FUZZ_png_error ------------------ 457| 6.88k| } 458| | 459| | /* libpng 1.5.6: the following line was copying png_ptr->rowbytes before 460| | * 1.5.6, while the buffer really is this big in current versions of libpng 461| | * it may not be in the future, so this was changed just to copy the 462| | * interlaced count: 463| | */ 464| 10.8k| memcpy(png_ptr->prev_row, png_ptr->row_buf, row_info.rowbytes + 1); 465| | 466| 10.8k|#ifdef PNG_MNG_FEATURES_SUPPORTED 467| 10.8k| if ((png_ptr->mng_features_permitted & PNG_FLAG_MNG_FILTER_64) != 0 && ------------------ | | 876| 10.8k|#define PNG_FLAG_MNG_FILTER_64 0x04 ------------------ | Branch (467:8): [True: 0, False: 10.8k] ------------------ 468| 0| (png_ptr->filter_type == PNG_INTRAPIXEL_DIFFERENCING)) ------------------ | | 681| 0|#define PNG_INTRAPIXEL_DIFFERENCING 64 /* Used only in MNG datastreams */ ------------------ | Branch (468:8): [True: 0, False: 0] ------------------ 469| 0| { 470| | /* Intrapixel differencing */ 471| 0| png_do_read_intrapixel(&row_info, png_ptr->row_buf + 1); 472| 0| } 473| 10.8k|#endif 474| | 475| 10.8k|#ifdef PNG_READ_TRANSFORMS_SUPPORTED 476| 10.8k| if (png_ptr->transformations ------------------ | Branch (476:8): [True: 10.3k, False: 530] ------------------ 477| 530|# ifdef PNG_CHECK_FOR_INVALID_INDEX_SUPPORTED 478| 530| || png_ptr->num_palette_max >= 0 ------------------ | Branch (478:13): [True: 530, False: 0] ------------------ 479| 10.8k|# endif 480| 10.8k| ) 481| 9.77k| png_do_read_transformations(png_ptr, &row_info); ------------------ | | 52| 9.77k|#define png_do_read_transformations OSS_FUZZ_png_do_read_transformations ------------------ 482| 10.8k|#endif 483| | 484| | /* The transformed pixel depth should match the depth now in row_info. */ 485| 10.8k| if (png_ptr->transformed_pixel_depth == 0) ------------------ | Branch (485:8): [True: 1.05k, False: 9.78k] ------------------ 486| 1.05k| { 487| 1.05k| png_ptr->transformed_pixel_depth = row_info.pixel_depth; 488| 1.05k| if (row_info.pixel_depth > png_ptr->maximum_pixel_depth) ------------------ | Branch (488:11): [True: 0, False: 1.05k] ------------------ 489| 0| png_error(png_ptr, "sequential row overflow"); ------------------ | | 252| 0|#define png_error OSS_FUZZ_png_error ------------------ 490| 1.05k| } 491| | 492| 9.78k| else if (png_ptr->transformed_pixel_depth != row_info.pixel_depth) ------------------ | Branch (492:13): [True: 0, False: 9.78k] ------------------ 493| 0| png_error(png_ptr, "internal sequential row size calculation error"); ------------------ | | 252| 0|#define png_error OSS_FUZZ_png_error ------------------ 494| | 495| 10.8k|#ifdef PNG_READ_INTERLACING_SUPPORTED 496| | /* Expand interlaced rows to full size */ 497| 10.8k| if (png_ptr->interlaced != 0 && ------------------ | Branch (497:8): [True: 6.98k, False: 3.85k] ------------------ 498| 6.98k| (png_ptr->transformations & PNG_INTERLACE) != 0) ------------------ | | 659| 6.98k|#define PNG_INTERLACE 0x0002U ------------------ | Branch (498:7): [True: 0, False: 6.98k] ------------------ 499| 0| { 500| 0| if (png_ptr->pass < 6) ------------------ | Branch (500:11): [True: 0, False: 0] ------------------ 501| 0| png_do_read_interlace(&row_info, png_ptr->row_buf + 1, png_ptr->pass, ------------------ | | 35| 0|#define png_do_read_interlace OSS_FUZZ_png_do_read_interlace ------------------ 502| 0| png_ptr->transformations); 503| | 504| 0| if (dsp_row != NULL) ------------------ | Branch (504:11): [True: 0, False: 0] ------------------ 505| 0| png_combine_row(png_ptr, dsp_row, 1/*display*/); ------------------ | | 34| 0|#define png_combine_row OSS_FUZZ_png_combine_row ------------------ 506| | 507| 0| if (row != NULL) ------------------ | Branch (507:11): [True: 0, False: 0] ------------------ 508| 0| png_combine_row(png_ptr, row, 0/*row*/); ------------------ | | 34| 0|#define png_combine_row OSS_FUZZ_png_combine_row ------------------ 509| 0| } 510| | 511| 10.8k| else 512| 10.8k|#endif 513| 10.8k| { 514| 10.8k| if (row != NULL) ------------------ | Branch (514:11): [True: 9.77k, False: 1.06k] ------------------ 515| 9.77k| png_combine_row(png_ptr, row, -1/*ignored*/); ------------------ | | 34| 9.77k|#define png_combine_row OSS_FUZZ_png_combine_row ------------------ 516| | 517| 10.8k| if (dsp_row != NULL) ------------------ | Branch (517:11): [True: 0, False: 10.8k] ------------------ 518| 0| png_combine_row(png_ptr, dsp_row, -1/*ignored*/); ------------------ | | 34| 0|#define png_combine_row OSS_FUZZ_png_combine_row ------------------ 519| 10.8k| } 520| 10.8k| png_read_finish_row(png_ptr); ------------------ | | 40| 10.8k|#define png_read_finish_row OSS_FUZZ_png_read_finish_row ------------------ 521| | 522| 10.8k| if (png_ptr->read_row_fn != NULL) ------------------ | Branch (522:8): [True: 0, False: 10.8k] ------------------ 523| 0| (*(png_ptr->read_row_fn))(png_ptr, png_ptr->row_number, png_ptr->pass); 524| 10.8k|} OSS_FUZZ_png_destroy_read_struct: 832| 6.52k|{ 833| 6.52k| png_structrp png_ptr = NULL; 834| | 835| 6.52k| png_debug(1, "in png_destroy_read_struct"); ------------------ | | 145| 6.52k|# define png_debug(l, m) ((void)0) ------------------ 836| | 837| 6.52k| if (png_ptr_ptr != NULL) ------------------ | Branch (837:8): [True: 6.52k, False: 0] ------------------ 838| 6.52k| png_ptr = *png_ptr_ptr; 839| | 840| 6.52k| if (png_ptr == NULL) ------------------ | Branch (840:8): [True: 0, False: 6.52k] ------------------ 841| 0| return; 842| | 843| | /* libpng 1.6.0: use the API to destroy info structs to ensure consistent 844| | * behavior. Prior to 1.6.0 libpng did extra 'info' destruction in this API. 845| | * The extra was, apparently, unnecessary yet this hides memory leak bugs. 846| | */ 847| 6.52k| png_destroy_info_struct(png_ptr, end_info_ptr_ptr); ------------------ | | 249| 6.52k|#define png_destroy_info_struct OSS_FUZZ_png_destroy_info_struct ------------------ 848| 6.52k| png_destroy_info_struct(png_ptr, info_ptr_ptr); ------------------ | | 249| 6.52k|#define png_destroy_info_struct OSS_FUZZ_png_destroy_info_struct ------------------ 849| | 850| 6.52k| *png_ptr_ptr = NULL; 851| 6.52k| png_read_destroy(png_ptr); 852| 6.52k| png_destroy_png_struct(png_ptr); ------------------ | | 12| 6.52k|#define png_destroy_png_struct OSS_FUZZ_png_destroy_png_struct ------------------ 853| 6.52k|} pngread.c:png_read_destroy: 761| 6.52k|{ 762| 6.52k| png_debug(1, "in png_read_destroy"); ------------------ | | 145| 6.52k|# define png_debug(l, m) ((void)0) ------------------ 763| | 764| 6.52k|#ifdef PNG_READ_GAMMA_SUPPORTED 765| 6.52k| png_destroy_gamma_table(png_ptr); ------------------ | | 96| 6.52k|#define png_destroy_gamma_table OSS_FUZZ_png_destroy_gamma_table ------------------ 766| 6.52k|#endif 767| | 768| 6.52k| png_free(png_ptr, png_ptr->big_row_buf); ------------------ | | 253| 6.52k|#define png_free OSS_FUZZ_png_free ------------------ 769| 6.52k| png_ptr->big_row_buf = NULL; 770| 6.52k| png_free(png_ptr, png_ptr->big_prev_row); ------------------ | | 253| 6.52k|#define png_free OSS_FUZZ_png_free ------------------ 771| 6.52k| png_ptr->big_prev_row = NULL; 772| 6.52k| png_free(png_ptr, png_ptr->read_buffer); ------------------ | | 253| 6.52k|#define png_free OSS_FUZZ_png_free ------------------ 773| 6.52k| png_ptr->read_buffer = NULL; 774| | 775| 6.52k|#ifdef PNG_READ_QUANTIZE_SUPPORTED 776| 6.52k| png_free(png_ptr, png_ptr->palette_lookup); ------------------ | | 253| 6.52k|#define png_free OSS_FUZZ_png_free ------------------ 777| 6.52k| png_ptr->palette_lookup = NULL; 778| 6.52k| png_free(png_ptr, png_ptr->quantize_index); ------------------ | | 253| 6.52k|#define png_free OSS_FUZZ_png_free ------------------ 779| 6.52k| png_ptr->quantize_index = NULL; 780| 6.52k|#endif 781| | 782| | /* png_ptr->palette is always independently allocated (not aliased 783| | * with info_ptr->palette), so free it unconditionally. 784| | */ 785| 6.52k| png_free(png_ptr, png_ptr->palette); ------------------ | | 253| 6.52k|#define png_free OSS_FUZZ_png_free ------------------ 786| 6.52k| png_ptr->palette = NULL; 787| | 788| 6.52k|#if defined(PNG_tRNS_SUPPORTED) || \ 789| 6.52k| defined(PNG_READ_EXPAND_SUPPORTED) || defined(PNG_READ_BACKGROUND_SUPPORTED) 790| | /* png_ptr->trans_alpha is always independently allocated (not aliased 791| | * with info_ptr->trans_alpha), so free it unconditionally. 792| | */ 793| 6.52k| png_free(png_ptr, png_ptr->trans_alpha); ------------------ | | 253| 6.52k|#define png_free OSS_FUZZ_png_free ------------------ 794| 6.52k| png_ptr->trans_alpha = NULL; 795| 6.52k|#endif 796| | 797| 6.52k| inflateEnd(&png_ptr->zstream); 798| | 799| 6.52k|#ifdef PNG_PROGRESSIVE_READ_SUPPORTED 800| 6.52k| png_free(png_ptr, png_ptr->save_buffer); ------------------ | | 253| 6.52k|#define png_free OSS_FUZZ_png_free ------------------ 801| 6.52k| png_ptr->save_buffer = NULL; 802| 6.52k|#endif 803| | 804| 6.52k|#if defined(PNG_STORE_UNKNOWN_CHUNKS_SUPPORTED) && \ 805| 6.52k| defined(PNG_READ_UNKNOWN_CHUNKS_SUPPORTED) 806| 6.52k| png_free(png_ptr, png_ptr->unknown_chunk.data); ------------------ | | 253| 6.52k|#define png_free OSS_FUZZ_png_free ------------------ 807| 6.52k| png_ptr->unknown_chunk.data = NULL; 808| 6.52k|#endif 809| | 810| 6.52k|#ifdef PNG_SET_UNKNOWN_CHUNKS_SUPPORTED 811| 6.52k| png_free(png_ptr, png_ptr->chunk_list); ------------------ | | 253| 6.52k|#define png_free OSS_FUZZ_png_free ------------------ 812| 6.52k| png_ptr->chunk_list = NULL; 813| 6.52k|#endif 814| | 815| 6.52k|#if defined(PNG_READ_EXPAND_SUPPORTED) && \ 816| 6.52k| (defined(PNG_ARM_NEON_IMPLEMENTATION) || \ 817| 6.52k| defined(PNG_RISCV_RVV_IMPLEMENTATION)) 818| 6.52k| png_free(png_ptr, png_ptr->riffled_palette); ------------------ | | 253| 6.52k|#define png_free OSS_FUZZ_png_free ------------------ 819| 6.52k| png_ptr->riffled_palette = NULL; 820| 6.52k|#endif 821| | 822| | /* NOTE: the 'setjmp' buffer may still be allocated and the memory and error 823| | * callbacks are still set at this point. They are required to complete the 824| | * destruction of the png_struct itself. 825| | */ 826| 6.52k|} OSS_FUZZ_png_read_data: 32| 303k|{ 33| 303k| png_debug1(4, "reading %d bytes", (int)length); ------------------ | | 148| 303k|# define png_debug1(l, m, p1) ((void)0) ------------------ 34| | 35| 303k| if (png_ptr->read_data_fn != NULL) ------------------ | Branch (35:8): [True: 303k, False: 0] ------------------ 36| 303k| (*(png_ptr->read_data_fn))(png_ptr, data, length); 37| | 38| 0| else 39| 0| png_error(png_ptr, "Call to NULL read function"); ------------------ | | 252| 0|#define png_error OSS_FUZZ_png_error ------------------ 40| 303k|} OSS_FUZZ_png_set_read_fn: 88| 13.0k|{ 89| 13.0k| if (png_ptr == NULL) ------------------ | Branch (89:8): [True: 0, False: 13.0k] ------------------ 90| 0| return; 91| | 92| 13.0k| png_ptr->io_ptr = io_ptr; 93| | 94| |#ifdef PNG_STDIO_SUPPORTED 95| | if (read_data_fn != NULL) 96| | png_ptr->read_data_fn = read_data_fn; 97| | 98| | else 99| | png_ptr->read_data_fn = png_default_read_data; 100| |#else 101| 13.0k| png_ptr->read_data_fn = read_data_fn; 102| 13.0k|#endif 103| | 104| |#ifdef PNG_WRITE_SUPPORTED 105| | /* It is an error to write to a read device */ 106| | if (png_ptr->write_data_fn != NULL) 107| | { 108| | png_ptr->write_data_fn = NULL; 109| | png_warning(png_ptr, 110| | "Can't set both read_data_fn and write_data_fn in the" 111| | " same structure"); 112| | } 113| |#endif 114| | 115| |#ifdef PNG_WRITE_FLUSH_SUPPORTED 116| | png_ptr->output_flush_fn = NULL; 117| |#endif 118| 13.0k|} OSS_FUZZ_png_set_scale_16: 189| 493|{ 190| 493| png_debug(1, "in png_set_scale_16"); ------------------ | | 145| 493|# define png_debug(l, m) ((void)0) ------------------ 191| | 192| 493| if (png_rtran_ok(png_ptr, 0) == 0) ------------------ | Branch (192:8): [True: 0, False: 493] ------------------ 193| 0| return; 194| | 195| 493| png_ptr->transformations |= PNG_SCALE_16_TO_8; ------------------ | | 685| 493|#define PNG_SCALE_16_TO_8 0x4000000U /* Added to libpng-1.5.4 */ ------------------ 196| 493|} OSS_FUZZ_png_set_alpha_mode_fixed: 363| 1.25k|{ 364| 1.25k| png_fixed_point file_gamma; 365| 1.25k| int compose = 0; 366| | 367| 1.25k| png_debug(1, "in png_set_alpha_mode_fixed"); ------------------ | | 145| 1.25k|# define png_debug(l, m) ((void)0) ------------------ 368| | 369| 1.25k| if (png_rtran_ok(png_ptr, 0) == 0) ------------------ | Branch (369:8): [True: 0, False: 1.25k] ------------------ 370| 0| return; 371| | 372| 1.25k| output_gamma = translate_gamma_flags(output_gamma, 1/*screen*/); 373| 1.25k| if (unsupported_gamma(png_ptr, output_gamma, 0/*error*/)) ------------------ | Branch (373:8): [True: 0, False: 1.25k] ------------------ 374| 0| return; 375| | 376| | /* The default file gamma is the inverse of the output gamma; the output 377| | * gamma may be changed below so get the file value first. The default_gamma 378| | * is set here and from the simplified API (which uses a different algorithm) 379| | * so don't overwrite a set value: 380| | */ 381| 1.25k| file_gamma = png_ptr->default_gamma; 382| 1.25k| if (file_gamma == 0) ------------------ | Branch (382:8): [True: 1.25k, False: 0] ------------------ 383| 1.25k| { 384| 1.25k| file_gamma = png_reciprocal(output_gamma); ------------------ | | 89| 1.25k|#define png_reciprocal OSS_FUZZ_png_reciprocal ------------------ 385| 1.25k| png_ptr->default_gamma = file_gamma; 386| 1.25k| } 387| | 388| | /* There are really 8 possibilities here, composed of any combination 389| | * of: 390| | * 391| | * premultiply the color channels 392| | * do not encode non-opaque pixels 393| | * encode the alpha as well as the color channels 394| | * 395| | * The differences disappear if the input/output ('screen') gamma is 1.0, 396| | * because then the encoding is a no-op and there is only the choice of 397| | * premultiplying the color channels or not. 398| | * 399| | * png_set_alpha_mode and png_set_background interact because both use 400| | * png_compose to do the work. Calling both is only useful when 401| | * png_set_alpha_mode is used to set the default mode - PNG_ALPHA_PNG - along 402| | * with a default gamma value. Otherwise PNG_COMPOSE must not be set. 403| | */ 404| 1.25k| switch (mode) 405| 1.25k| { 406| 0| case PNG_ALPHA_PNG: /* default: png standard */ ------------------ | | 1172| 0|#define PNG_ALPHA_PNG 0 /* according to the PNG standard */ ------------------ | Branch (406:7): [True: 0, False: 1.25k] ------------------ 407| | /* No compose, but it may be set by png_set_background! */ 408| 0| png_ptr->transformations &= ~PNG_ENCODE_ALPHA; ------------------ | | 682| 0|#define PNG_ENCODE_ALPHA 0x800000U /* Added to libpng-1.5.4 */ ------------------ 409| 0| png_ptr->flags &= ~PNG_FLAG_OPTIMIZE_ALPHA; ------------------ | | 708| 0|#define PNG_FLAG_OPTIMIZE_ALPHA 0x2000U /* Added to libpng-1.5.4 */ ------------------ 410| 0| break; 411| | 412| 1.25k| case PNG_ALPHA_ASSOCIATED: /* color channels premultiplied */ ------------------ | | 1174| 1.25k|#define PNG_ALPHA_ASSOCIATED 1 /* as above; this is the normal practice */ ------------------ | Branch (412:7): [True: 1.25k, False: 0] ------------------ 413| 1.25k| compose = 1; 414| 1.25k| png_ptr->transformations &= ~PNG_ENCODE_ALPHA; ------------------ | | 682| 1.25k|#define PNG_ENCODE_ALPHA 0x800000U /* Added to libpng-1.5.4 */ ------------------ 415| 1.25k| png_ptr->flags &= ~PNG_FLAG_OPTIMIZE_ALPHA; ------------------ | | 708| 1.25k|#define PNG_FLAG_OPTIMIZE_ALPHA 0x2000U /* Added to libpng-1.5.4 */ ------------------ 416| | /* The output is linear: */ 417| 1.25k| output_gamma = PNG_FP_1; ------------------ | | 654| 1.25k|#define PNG_FP_1 100000 ------------------ 418| 1.25k| break; 419| | 420| 0| case PNG_ALPHA_OPTIMIZED: /* associated, non-opaque pixels linear */ ------------------ | | 1176| 0|#define PNG_ALPHA_OPTIMIZED 2 /* 'PNG' for opaque pixels, else 'STANDARD' */ ------------------ | Branch (420:7): [True: 0, False: 1.25k] ------------------ 421| 0| compose = 1; 422| 0| png_ptr->transformations &= ~PNG_ENCODE_ALPHA; ------------------ | | 682| 0|#define PNG_ENCODE_ALPHA 0x800000U /* Added to libpng-1.5.4 */ ------------------ 423| 0| png_ptr->flags |= PNG_FLAG_OPTIMIZE_ALPHA; ------------------ | | 708| 0|#define PNG_FLAG_OPTIMIZE_ALPHA 0x2000U /* Added to libpng-1.5.4 */ ------------------ 424| | /* output_gamma records the encoding of opaque pixels! */ 425| 0| break; 426| | 427| 0| case PNG_ALPHA_BROKEN: /* associated, non-linear, alpha encoded */ ------------------ | | 1177| 0|#define PNG_ALPHA_BROKEN 3 /* the alpha channel is gamma encoded */ ------------------ | Branch (427:7): [True: 0, False: 1.25k] ------------------ 428| 0| compose = 1; 429| 0| png_ptr->transformations |= PNG_ENCODE_ALPHA; ------------------ | | 682| 0|#define PNG_ENCODE_ALPHA 0x800000U /* Added to libpng-1.5.4 */ ------------------ 430| 0| png_ptr->flags &= ~PNG_FLAG_OPTIMIZE_ALPHA; ------------------ | | 708| 0|#define PNG_FLAG_OPTIMIZE_ALPHA 0x2000U /* Added to libpng-1.5.4 */ ------------------ 431| 0| break; 432| | 433| 0| default: ------------------ | Branch (433:7): [True: 0, False: 1.25k] ------------------ 434| 0| png_error(png_ptr, "invalid alpha mode"); ------------------ | | 252| 0|#define png_error OSS_FUZZ_png_error ------------------ 435| 1.25k| } 436| | 437| | /* Set the screen gamma values: */ 438| 1.25k| png_ptr->screen_gamma = output_gamma; 439| | 440| | /* Finally, if pre-multiplying, set the background fields to achieve the 441| | * desired result. 442| | */ 443| 1.25k| if (compose != 0) ------------------ | Branch (443:8): [True: 1.25k, False: 0] ------------------ 444| 1.25k| { 445| | /* And obtain alpha pre-multiplication by composing on black: */ 446| 1.25k| memset(&png_ptr->background, 0, (sizeof png_ptr->background)); 447| 1.25k| png_ptr->background_gamma = file_gamma; /* just in case */ 448| 1.25k| png_ptr->background_gamma_type = PNG_BACKGROUND_GAMMA_FILE; ------------------ | | 1361| 1.25k|# define PNG_BACKGROUND_GAMMA_FILE 2 ------------------ 449| 1.25k| png_ptr->transformations &= ~PNG_BACKGROUND_EXPAND; ------------------ | | 666| 1.25k|#define PNG_BACKGROUND_EXPAND 0x0100U ------------------ 450| | 451| 1.25k| if ((png_ptr->transformations & PNG_COMPOSE) != 0) ------------------ | | 665| 1.25k|#define PNG_COMPOSE 0x0080U /* Was PNG_BACKGROUND */ ------------------ | Branch (451:11): [True: 0, False: 1.25k] ------------------ 452| 0| png_error(png_ptr, ------------------ | | 252| 0|#define png_error OSS_FUZZ_png_error ------------------ 453| 0| "conflicting calls to set alpha mode and background"); 454| | 455| 1.25k| png_ptr->transformations |= PNG_COMPOSE; ------------------ | | 665| 1.25k|#define PNG_COMPOSE 0x0080U /* Was PNG_BACKGROUND */ ------------------ 456| 1.25k| } 457| 1.25k|} OSS_FUZZ_png_set_alpha_mode: 462| 1.25k|{ 463| 1.25k| png_set_alpha_mode_fixed(png_ptr, mode, convert_gamma_value(png_ptr, ------------------ | | 367| 1.25k|#define png_set_alpha_mode_fixed OSS_FUZZ_png_set_alpha_mode_fixed ------------------ 464| 1.25k| output_gamma)); 465| 1.25k|} OSS_FUZZ_png_set_quantize: 492| 505|{ 493| 505| png_debug(1, "in png_set_quantize"); ------------------ | | 145| 505|# define png_debug(l, m) ((void)0) ------------------ 494| | 495| 505| if (png_rtran_ok(png_ptr, 0) == 0) ------------------ | Branch (495:8): [True: 0, False: 505] ------------------ 496| 0| return; 497| | 498| 505| if (palette == NULL) ------------------ | Branch (498:8): [True: 0, False: 505] ------------------ 499| 0| return; 500| | 501| 505| png_ptr->transformations |= PNG_QUANTIZE; ------------------ | | 664| 505|#define PNG_QUANTIZE 0x0040U ------------------ 502| | 503| 505| if (full_quantize == 0) ------------------ | Branch (503:8): [True: 505, False: 0] ------------------ 504| 505| { 505| 505| int i; 506| | 507| | /* Initialize the array to index colors. 508| | * 509| | * Ensure quantize_index can fit 256 elements (PNG_MAX_PALETTE_LENGTH) 510| | * rather than num_palette elements. This is to prevent buffer overflows 511| | * caused by malformed PNG files with out-of-range palette indices. 512| | * 513| | * Be careful to avoid leaking memory. Applications are allowed to call 514| | * this function more than once per png_struct. 515| | */ 516| 505| png_free(png_ptr, png_ptr->quantize_index); ------------------ | | 253| 505|#define png_free OSS_FUZZ_png_free ------------------ 517| 505| png_ptr->quantize_index = (png_bytep)png_malloc(png_ptr, ------------------ | | 347| 505|#define png_malloc OSS_FUZZ_png_malloc ------------------ 518| 505| PNG_MAX_PALETTE_LENGTH); ------------------ | | 723| 505|#define PNG_MAX_PALETTE_LENGTH 256 ------------------ 519| 129k| for (i = 0; i < PNG_MAX_PALETTE_LENGTH; i++) ------------------ | | 723| 129k|#define PNG_MAX_PALETTE_LENGTH 256 ------------------ | Branch (519:19): [True: 129k, False: 505] ------------------ 520| 129k| png_ptr->quantize_index[i] = (png_byte)i; 521| 505| } 522| | 523| 505| if (num_palette > maximum_colors) ------------------ | Branch (523:8): [True: 0, False: 505] ------------------ 524| 0| { 525| 0| if (histogram != NULL) ------------------ | Branch (525:11): [True: 0, False: 0] ------------------ 526| 0| { 527| | /* This is easy enough, just throw out the least used colors. 528| | * Perhaps not the best solution, but good enough. 529| | */ 530| | 531| 0| png_bytep quantize_sort; 532| 0| int i, j; 533| | 534| | /* Initialize the local array to sort colors. */ 535| 0| quantize_sort = (png_bytep)png_malloc(png_ptr, ------------------ | | 347| 0|#define png_malloc OSS_FUZZ_png_malloc ------------------ 536| 0| (png_alloc_size_t)num_palette); 537| 0| for (i = 0; i < num_palette; i++) ------------------ | Branch (537:22): [True: 0, False: 0] ------------------ 538| 0| quantize_sort[i] = (png_byte)i; 539| | 540| | /* Find the least used palette entries by starting a 541| | * bubble sort, and running it until we have sorted 542| | * out enough colors. Note that we don't care about 543| | * sorting all the colors, just finding which are 544| | * least used. 545| | */ 546| | 547| 0| for (i = num_palette - 1; i >= maximum_colors; i--) ------------------ | Branch (547:36): [True: 0, False: 0] ------------------ 548| 0| { 549| 0| int done; /* To stop early if the list is pre-sorted */ 550| | 551| 0| done = 1; 552| 0| for (j = 0; j < i; j++) ------------------ | Branch (552:25): [True: 0, False: 0] ------------------ 553| 0| { 554| 0| if (histogram[quantize_sort[j]] ------------------ | Branch (554:20): [True: 0, False: 0] ------------------ 555| 0| < histogram[quantize_sort[j + 1]]) 556| 0| { 557| 0| png_byte t; 558| | 559| 0| t = quantize_sort[j]; 560| 0| quantize_sort[j] = quantize_sort[j + 1]; 561| 0| quantize_sort[j + 1] = t; 562| 0| done = 0; 563| 0| } 564| 0| } 565| | 566| 0| if (done != 0) ------------------ | Branch (566:17): [True: 0, False: 0] ------------------ 567| 0| break; 568| 0| } 569| | 570| | /* Swap the palette around, and set up a table, if necessary */ 571| 0| if (full_quantize != 0) ------------------ | Branch (571:14): [True: 0, False: 0] ------------------ 572| 0| { 573| 0| j = num_palette; 574| | 575| | /* Put all the useful colors within the max, but don't 576| | * move the others. 577| | */ 578| 0| for (i = 0; i < maximum_colors; i++) ------------------ | Branch (578:25): [True: 0, False: 0] ------------------ 579| 0| { 580| 0| if ((int)quantize_sort[i] >= maximum_colors) ------------------ | Branch (580:20): [True: 0, False: 0] ------------------ 581| 0| { 582| 0| do 583| 0| j--; 584| 0| while ((int)quantize_sort[j] >= maximum_colors); ------------------ | Branch (584:26): [True: 0, False: 0] ------------------ 585| | 586| 0| palette[i] = palette[j]; 587| 0| } 588| 0| } 589| 0| } 590| 0| else 591| 0| { 592| 0| j = num_palette; 593| | 594| | /* Move all the used colors inside the max limit, and 595| | * develop a translation table. 596| | */ 597| 0| for (i = 0; i < maximum_colors; i++) ------------------ | Branch (597:25): [True: 0, False: 0] ------------------ 598| 0| { 599| | /* Only move the colors we need to */ 600| 0| if ((int)quantize_sort[i] >= maximum_colors) ------------------ | Branch (600:20): [True: 0, False: 0] ------------------ 601| 0| { 602| 0| png_color tmp_color; 603| | 604| 0| do 605| 0| j--; 606| 0| while ((int)quantize_sort[j] >= maximum_colors); ------------------ | Branch (606:26): [True: 0, False: 0] ------------------ 607| | 608| 0| tmp_color = palette[j]; 609| 0| palette[j] = palette[i]; 610| 0| palette[i] = tmp_color; 611| | /* Indicate where the color went */ 612| 0| png_ptr->quantize_index[j] = (png_byte)i; 613| 0| png_ptr->quantize_index[i] = (png_byte)j; 614| 0| } 615| 0| } 616| | 617| | /* Find closest color for those colors we are not using */ 618| 0| for (i = 0; i < num_palette; i++) ------------------ | Branch (618:25): [True: 0, False: 0] ------------------ 619| 0| { 620| 0| if ((int)png_ptr->quantize_index[i] >= maximum_colors) ------------------ | Branch (620:20): [True: 0, False: 0] ------------------ 621| 0| { 622| 0| int min_d, k, min_k, d_index; 623| | 624| | /* Find the closest color to one we threw out */ 625| 0| d_index = png_ptr->quantize_index[i]; 626| 0| min_d = PNG_COLOR_DIST(palette[d_index], palette[0]); ------------------ | | 738| 0|#define PNG_COLOR_DIST(c1, c2) (abs((int)((c1).red) - (int)((c2).red)) + \ | | 739| 0| abs((int)((c1).green) - (int)((c2).green)) + \ | | 740| 0| abs((int)((c1).blue) - (int)((c2).blue))) ------------------ 627| 0| for (k = 1, min_k = 0; k < maximum_colors; k++) ------------------ | Branch (627:42): [True: 0, False: 0] ------------------ 628| 0| { 629| 0| int d; 630| | 631| 0| d = PNG_COLOR_DIST(palette[d_index], palette[k]); ------------------ | | 738| 0|#define PNG_COLOR_DIST(c1, c2) (abs((int)((c1).red) - (int)((c2).red)) + \ | | 739| 0| abs((int)((c1).green) - (int)((c2).green)) + \ | | 740| 0| abs((int)((c1).blue) - (int)((c2).blue))) ------------------ 632| | 633| 0| if (d < min_d) ------------------ | Branch (633:26): [True: 0, False: 0] ------------------ 634| 0| { 635| 0| min_d = d; 636| 0| min_k = k; 637| 0| } 638| 0| } 639| | /* Point to closest color */ 640| 0| png_ptr->quantize_index[i] = (png_byte)min_k; 641| 0| } 642| 0| } 643| 0| } 644| 0| png_free(png_ptr, quantize_sort); ------------------ | | 253| 0|#define png_free OSS_FUZZ_png_free ------------------ 645| 0| } 646| 0| else 647| 0| { 648| | /* This is much harder to do simply (and quickly). Perhaps 649| | * we need to go through a median cut routine, but those 650| | * don't always behave themselves with only a few colors 651| | * as input. So we will just find the closest two colors, 652| | * and throw out one of them (chosen somewhat randomly). 653| | * [We don't understand this at all, so if someone wants to 654| | * work on improving it, be our guest - AED, GRP] 655| | */ 656| 0| int i; 657| 0| int max_d; 658| 0| int num_new_palette; 659| 0| png_dsortp t; 660| 0| png_dsortpp hash; 661| | 662| 0| t = NULL; 663| | 664| | /* Initialize palette index arrays */ 665| 0| png_ptr->index_to_palette = (png_bytep)png_malloc(png_ptr, ------------------ | | 347| 0|#define png_malloc OSS_FUZZ_png_malloc ------------------ 666| 0| (png_alloc_size_t)num_palette); 667| 0| png_ptr->palette_to_index = (png_bytep)png_malloc(png_ptr, ------------------ | | 347| 0|#define png_malloc OSS_FUZZ_png_malloc ------------------ 668| 0| (png_alloc_size_t)num_palette); 669| | 670| | /* Initialize the sort array */ 671| 0| for (i = 0; i < num_palette; i++) ------------------ | Branch (671:22): [True: 0, False: 0] ------------------ 672| 0| { 673| 0| png_ptr->index_to_palette[i] = (png_byte)i; 674| 0| png_ptr->palette_to_index[i] = (png_byte)i; 675| 0| } 676| | 677| 0| hash = (png_dsortpp)png_calloc(png_ptr, (png_alloc_size_t)(769 * ------------------ | | 237| 0|#define png_calloc OSS_FUZZ_png_calloc ------------------ 678| 0| (sizeof (png_dsortp)))); 679| | 680| 0| num_new_palette = num_palette; 681| | 682| | /* Initial wild guess at how far apart the farthest pixel 683| | * pair we will be eliminating will be. Larger 684| | * numbers mean more areas will be allocated, Smaller 685| | * numbers run the risk of not saving enough data, and 686| | * having to do this all over again. 687| | * 688| | * I have not done extensive checking on this number. 689| | */ 690| 0| max_d = 96; 691| | 692| 0| while (num_new_palette > maximum_colors) ------------------ | Branch (692:17): [True: 0, False: 0] ------------------ 693| 0| { 694| 0| for (i = 0; i < num_new_palette - 1; i++) ------------------ | Branch (694:25): [True: 0, False: 0] ------------------ 695| 0| { 696| 0| int j; 697| | 698| 0| for (j = i + 1; j < num_new_palette; j++) ------------------ | Branch (698:32): [True: 0, False: 0] ------------------ 699| 0| { 700| 0| int d; 701| | 702| 0| d = PNG_COLOR_DIST(palette[i], palette[j]); ------------------ | | 738| 0|#define PNG_COLOR_DIST(c1, c2) (abs((int)((c1).red) - (int)((c2).red)) + \ | | 739| 0| abs((int)((c1).green) - (int)((c2).green)) + \ | | 740| 0| abs((int)((c1).blue) - (int)((c2).blue))) ------------------ 703| | 704| 0| if (d <= max_d) ------------------ | Branch (704:23): [True: 0, False: 0] ------------------ 705| 0| { 706| | 707| 0| t = (png_dsortp)png_malloc_warn(png_ptr, ------------------ | | 349| 0|#define png_malloc_warn OSS_FUZZ_png_malloc_warn ------------------ 708| 0| (png_alloc_size_t)(sizeof (png_dsort))); 709| | 710| 0| if (t == NULL) ------------------ | Branch (710:26): [True: 0, False: 0] ------------------ 711| 0| break; 712| | 713| 0| t->next = hash[d]; 714| 0| t->left = png_ptr->palette_to_index[i]; 715| 0| t->right = png_ptr->palette_to_index[j]; 716| 0| hash[d] = t; 717| 0| } 718| 0| } 719| 0| if (t == NULL) ------------------ | Branch (719:20): [True: 0, False: 0] ------------------ 720| 0| break; 721| 0| } 722| | 723| 0| if (t != NULL) ------------------ | Branch (723:17): [True: 0, False: 0] ------------------ 724| 0| for (i = 0; i <= max_d; i++) ------------------ | Branch (724:25): [True: 0, False: 0] ------------------ 725| 0| { 726| 0| if (hash[i] != NULL) ------------------ | Branch (726:20): [True: 0, False: 0] ------------------ 727| 0| { 728| 0| png_dsortp p; 729| | 730| 0| for (p = hash[i]; p; p = p->next) ------------------ | Branch (730:37): [True: 0, False: 0] ------------------ 731| 0| { 732| 0| if ((int)png_ptr->index_to_palette[p->left] ------------------ | Branch (732:26): [True: 0, False: 0] ------------------ 733| 0| < num_new_palette && 734| 0| (int)png_ptr->index_to_palette[p->right] ------------------ | Branch (734:26): [True: 0, False: 0] ------------------ 735| 0| < num_new_palette) 736| 0| { 737| 0| int j, next_j; 738| | 739| 0| if (num_new_palette & 0x01) ------------------ | Branch (739:29): [True: 0, False: 0] ------------------ 740| 0| { 741| 0| j = p->left; 742| 0| next_j = p->right; 743| 0| } 744| 0| else 745| 0| { 746| 0| j = p->right; 747| 0| next_j = p->left; 748| 0| } 749| | 750| 0| num_new_palette--; 751| 0| palette[png_ptr->index_to_palette[j]] 752| 0| = palette[num_new_palette]; 753| 0| if (full_quantize == 0) ------------------ | Branch (753:29): [True: 0, False: 0] ------------------ 754| 0| { 755| 0| int k; 756| | 757| 0| for (k = 0; k < num_palette; k++) ------------------ | Branch (757:40): [True: 0, False: 0] ------------------ 758| 0| { 759| 0| if (png_ptr->quantize_index[k] == ------------------ | Branch (759:35): [True: 0, False: 0] ------------------ 760| 0| png_ptr->index_to_palette[j]) 761| 0| png_ptr->quantize_index[k] = 762| 0| png_ptr->index_to_palette[next_j]; 763| | 764| 0| if ((int)png_ptr->quantize_index[k] == ------------------ | Branch (764:35): [True: 0, False: 0] ------------------ 765| 0| num_new_palette) 766| 0| png_ptr->quantize_index[k] = 767| 0| png_ptr->index_to_palette[j]; 768| 0| } 769| 0| } 770| | 771| 0| png_ptr->index_to_palette[png_ptr->palette_to_index 772| 0| [num_new_palette]] = png_ptr->index_to_palette[j]; 773| | 774| 0| png_ptr->palette_to_index[png_ptr->index_to_palette[j]] 775| 0| = png_ptr->palette_to_index[num_new_palette]; 776| | 777| 0| png_ptr->index_to_palette[j] = 778| 0| (png_byte)num_new_palette; 779| | 780| 0| png_ptr->palette_to_index[num_new_palette] = 781| 0| (png_byte)j; 782| 0| } 783| 0| if (num_new_palette <= maximum_colors) ------------------ | Branch (783:26): [True: 0, False: 0] ------------------ 784| 0| break; 785| 0| } 786| 0| if (num_new_palette <= maximum_colors) ------------------ | Branch (786:23): [True: 0, False: 0] ------------------ 787| 0| break; 788| 0| } 789| 0| } 790| | 791| 0| for (i = 0; i < 769; i++) ------------------ | Branch (791:25): [True: 0, False: 0] ------------------ 792| 0| { 793| 0| if (hash[i] != NULL) ------------------ | Branch (793:20): [True: 0, False: 0] ------------------ 794| 0| { 795| 0| png_dsortp p = hash[i]; 796| 0| while (p) ------------------ | Branch (796:26): [True: 0, False: 0] ------------------ 797| 0| { 798| 0| t = p->next; 799| 0| png_free(png_ptr, p); ------------------ | | 253| 0|#define png_free OSS_FUZZ_png_free ------------------ 800| 0| p = t; 801| 0| } 802| 0| } 803| 0| hash[i] = 0; 804| 0| } 805| 0| max_d += 96; 806| 0| } 807| 0| png_free(png_ptr, hash); ------------------ | | 253| 0|#define png_free OSS_FUZZ_png_free ------------------ 808| 0| png_free(png_ptr, png_ptr->palette_to_index); ------------------ | | 253| 0|#define png_free OSS_FUZZ_png_free ------------------ 809| 0| png_free(png_ptr, png_ptr->index_to_palette); ------------------ | | 253| 0|#define png_free OSS_FUZZ_png_free ------------------ 810| 0| png_ptr->palette_to_index = NULL; 811| 0| png_ptr->index_to_palette = NULL; 812| 0| } 813| 0| num_palette = maximum_colors; 814| 0| } 815| 505| if (png_ptr->palette == NULL) ------------------ | Branch (815:8): [True: 504, False: 1] ------------------ 816| 504| { 817| | /* Allocate an owned copy rather than aliasing the caller's pointer, 818| | * so that png_read_destroy can free png_ptr->palette unconditionally. 819| | */ 820| 504| png_ptr->palette = png_voidcast(png_colorp, png_calloc(png_ptr, ------------------ | | 535| 504|# define png_voidcast(type, value) (value) ------------------ 821| 504| PNG_MAX_PALETTE_LENGTH * (sizeof (png_color)))); 822| 504| memcpy(png_ptr->palette, palette, (unsigned int)num_palette * 823| 504| (sizeof (png_color))); 824| 504| } 825| 505| png_ptr->num_palette = (png_uint_16)num_palette; 826| | 827| 505| if (full_quantize != 0) ------------------ | Branch (827:8): [True: 0, False: 505] ------------------ 828| 0| { 829| 0| int i; 830| 0| png_bytep distance; 831| 0| int total_bits = PNG_QUANTIZE_RED_BITS + PNG_QUANTIZE_GREEN_BITS + ------------------ | | 219| 0|#define PNG_QUANTIZE_RED_BITS 5 ------------------ int total_bits = PNG_QUANTIZE_RED_BITS + PNG_QUANTIZE_GREEN_BITS + ------------------ | | 218| 0|#define PNG_QUANTIZE_GREEN_BITS 5 ------------------ 832| 0| PNG_QUANTIZE_BLUE_BITS; ------------------ | | 217| 0|#define PNG_QUANTIZE_BLUE_BITS 5 ------------------ 833| 0| int num_red = (1 << PNG_QUANTIZE_RED_BITS); ------------------ | | 219| 0|#define PNG_QUANTIZE_RED_BITS 5 ------------------ 834| 0| int num_green = (1 << PNG_QUANTIZE_GREEN_BITS); ------------------ | | 218| 0|#define PNG_QUANTIZE_GREEN_BITS 5 ------------------ 835| 0| int num_blue = (1 << PNG_QUANTIZE_BLUE_BITS); ------------------ | | 217| 0|#define PNG_QUANTIZE_BLUE_BITS 5 ------------------ 836| 0| size_t num_entries = ((size_t)1 << total_bits); 837| | 838| 0| png_ptr->palette_lookup = (png_bytep)png_calloc(png_ptr, ------------------ | | 237| 0|#define png_calloc OSS_FUZZ_png_calloc ------------------ 839| 0| (png_alloc_size_t)(num_entries)); 840| | 841| 0| distance = (png_bytep)png_malloc(png_ptr, (png_alloc_size_t)num_entries); ------------------ | | 347| 0|#define png_malloc OSS_FUZZ_png_malloc ------------------ 842| | 843| 0| memset(distance, 0xff, num_entries); 844| | 845| 0| for (i = 0; i < num_palette; i++) ------------------ | Branch (845:19): [True: 0, False: 0] ------------------ 846| 0| { 847| 0| int ir, ig, ib; 848| 0| int r = (palette[i].red >> (8 - PNG_QUANTIZE_RED_BITS)); ------------------ | | 219| 0|#define PNG_QUANTIZE_RED_BITS 5 ------------------ 849| 0| int g = (palette[i].green >> (8 - PNG_QUANTIZE_GREEN_BITS)); ------------------ | | 218| 0|#define PNG_QUANTIZE_GREEN_BITS 5 ------------------ 850| 0| int b = (palette[i].blue >> (8 - PNG_QUANTIZE_BLUE_BITS)); ------------------ | | 217| 0|#define PNG_QUANTIZE_BLUE_BITS 5 ------------------ 851| | 852| 0| for (ir = 0; ir < num_red; ir++) ------------------ | Branch (852:23): [True: 0, False: 0] ------------------ 853| 0| { 854| | /* int dr = abs(ir - r); */ 855| 0| int dr = ((ir > r) ? ir - r : r - ir); ------------------ | Branch (855:23): [True: 0, False: 0] ------------------ 856| 0| int index_r = (ir << (PNG_QUANTIZE_BLUE_BITS + ------------------ | | 217| 0|#define PNG_QUANTIZE_BLUE_BITS 5 ------------------ 857| 0| PNG_QUANTIZE_GREEN_BITS)); ------------------ | | 218| 0|#define PNG_QUANTIZE_GREEN_BITS 5 ------------------ 858| | 859| 0| for (ig = 0; ig < num_green; ig++) ------------------ | Branch (859:26): [True: 0, False: 0] ------------------ 860| 0| { 861| | /* int dg = abs(ig - g); */ 862| 0| int dg = ((ig > g) ? ig - g : g - ig); ------------------ | Branch (862:26): [True: 0, False: 0] ------------------ 863| 0| int dt = dr + dg; 864| 0| int dm = ((dr > dg) ? dr : dg); ------------------ | Branch (864:26): [True: 0, False: 0] ------------------ 865| 0| int index_g = index_r | (ig << PNG_QUANTIZE_BLUE_BITS); ------------------ | | 217| 0|#define PNG_QUANTIZE_BLUE_BITS 5 ------------------ 866| | 867| 0| for (ib = 0; ib < num_blue; ib++) ------------------ | Branch (867:29): [True: 0, False: 0] ------------------ 868| 0| { 869| 0| int d_index = index_g | ib; 870| | /* int db = abs(ib - b); */ 871| 0| int db = ((ib > b) ? ib - b : b - ib); ------------------ | Branch (871:29): [True: 0, False: 0] ------------------ 872| 0| int dmax = ((dm > db) ? dm : db); ------------------ | Branch (872:31): [True: 0, False: 0] ------------------ 873| 0| int d = dmax + dt + db; 874| | 875| 0| if (d < (int)distance[d_index]) ------------------ | Branch (875:23): [True: 0, False: 0] ------------------ 876| 0| { 877| 0| distance[d_index] = (png_byte)d; 878| 0| png_ptr->palette_lookup[d_index] = (png_byte)i; 879| 0| } 880| 0| } 881| 0| } 882| 0| } 883| 0| } 884| | 885| 0| png_free(png_ptr, distance); ------------------ | | 253| 0|#define png_free OSS_FUZZ_png_free ------------------ 886| 0| } 887| 505|} OSS_FUZZ_png_resolve_file_gamma: 1352| 1.25k|{ 1353| 1.25k| png_fixed_point file_gamma; 1354| | 1355| | /* The file gamma is determined by these precedence rules, in this order 1356| | * (i.e. use the first value found): 1357| | * 1358| | * png_set_gamma; png_struct::file_gammma if not zero, then: 1359| | * png_struct::chunk_gamma if not 0 (determined the PNGv3 rules), then: 1360| | * png_set_gamma; 1/png_struct::screen_gamma if not zero 1361| | * 1362| | * 0 (i.e. do no gamma handling) 1363| | */ 1364| 1.25k| file_gamma = png_ptr->file_gamma; 1365| 1.25k| if (file_gamma != 0) ------------------ | Branch (1365:8): [True: 0, False: 1.25k] ------------------ 1366| 0| return file_gamma; 1367| | 1368| 1.25k| file_gamma = png_ptr->chunk_gamma; 1369| 1.25k| if (file_gamma != 0) ------------------ | Branch (1369:8): [True: 464, False: 786] ------------------ 1370| 464| return file_gamma; 1371| | 1372| 786| file_gamma = png_ptr->default_gamma; 1373| 786| if (file_gamma != 0) ------------------ | Branch (1373:8): [True: 786, False: 0] ------------------ 1374| 786| return file_gamma; 1375| | 1376| | /* If png_reciprocal overflows, it returns 0, indicating to the caller that 1377| | * there is no usable file gamma. (The checks added to png_set_gamma and 1378| | * png_set_alpha_mode should prevent a screen_gamma which would overflow.) 1379| | */ 1380| 0| if (png_ptr->screen_gamma != 0) ------------------ | Branch (1380:8): [True: 0, False: 0] ------------------ 1381| 0| file_gamma = png_reciprocal(png_ptr->screen_gamma); ------------------ | | 89| 0|#define png_reciprocal OSS_FUZZ_png_reciprocal ------------------ 1382| | 1383| 0| return file_gamma; 1384| 786|} OSS_FUZZ_png_init_read_transformations: 1425| 1.25k|{ 1426| 1.25k| png_debug(1, "in png_init_read_transformations"); ------------------ | | 145| 1.25k|# define png_debug(l, m) ((void)0) ------------------ 1427| | 1428| | /* This internal function is called from png_read_start_row in pngrutil.c 1429| | * and it is called before the 'rowbytes' calculation is done, so the code 1430| | * in here can change or update the transformations flags. 1431| | * 1432| | * First do updates that do not depend on the details of the PNG image data 1433| | * being processed. 1434| | */ 1435| | 1436| 1.25k|#ifdef PNG_READ_GAMMA_SUPPORTED 1437| | /* Prior to 1.5.4 these tests were performed from png_set_gamma, 1.5.4 adds 1438| | * png_set_alpha_mode and this is another source for a default file gamma so 1439| | * the test needs to be performed later - here. In addition prior to 1.5.4 1440| | * the tests were repeated for the PALETTE color type here - this is no 1441| | * longer necessary (and doesn't seem to have been necessary before.) 1442| | * 1443| | * PNGv3: the new mandatory precedence/priority rules for colour space chunks 1444| | * are handled here (by calling the above function). 1445| | * 1446| | * Turn the gamma transformation on or off as appropriate. Notice that 1447| | * PNG_GAMMA just refers to the file->screen correction. Alpha composition 1448| | * may independently cause gamma correction because it needs linear data 1449| | * (e.g. if the file has a gAMA chunk but the screen gamma hasn't been 1450| | * specified.) In any case this flag may get turned off in the code 1451| | * immediately below if the transform can be handled outside the row loop. 1452| | */ 1453| 1.25k| if (png_init_gamma_values(png_ptr) != 0) ------------------ | Branch (1453:8): [True: 456, False: 794] ------------------ 1454| 456| png_ptr->transformations |= PNG_GAMMA; ------------------ | | 671| 456|#define PNG_GAMMA 0x2000U ------------------ 1455| | 1456| 794| else 1457| 794| png_ptr->transformations &= ~PNG_GAMMA; ------------------ | | 671| 794|#define PNG_GAMMA 0x2000U ------------------ 1458| 1.25k|#endif 1459| | 1460| | /* Certain transformations have the effect of preventing other 1461| | * transformations that happen afterward in png_do_read_transformations; 1462| | * resolve the interdependencies here. From the code of 1463| | * png_do_read_transformations the order is: 1464| | * 1465| | * 1) PNG_EXPAND (including PNG_EXPAND_tRNS) 1466| | * 2) PNG_STRIP_ALPHA (if no compose) 1467| | * 3) PNG_RGB_TO_GRAY 1468| | * 4) PNG_GRAY_TO_RGB iff !PNG_BACKGROUND_IS_GRAY 1469| | * 5) PNG_COMPOSE 1470| | * 6) PNG_GAMMA 1471| | * 7) PNG_STRIP_ALPHA (if compose) 1472| | * 8) PNG_ENCODE_ALPHA 1473| | * 9) PNG_SCALE_16_TO_8 1474| | * 10) PNG_16_TO_8 1475| | * 11) PNG_QUANTIZE (converts to palette) 1476| | * 12) PNG_EXPAND_16 1477| | * 13) PNG_GRAY_TO_RGB iff PNG_BACKGROUND_IS_GRAY 1478| | * 14) PNG_INVERT_MONO 1479| | * 15) PNG_INVERT_ALPHA 1480| | * 16) PNG_SHIFT 1481| | * 17) PNG_PACK 1482| | * 18) PNG_BGR 1483| | * 19) PNG_PACKSWAP 1484| | * 20) PNG_FILLER (includes PNG_ADD_ALPHA) 1485| | * 21) PNG_SWAP_ALPHA 1486| | * 22) PNG_SWAP_BYTES 1487| | * 23) PNG_USER_TRANSFORM [must be last] 1488| | */ 1489| 1.25k|#ifdef PNG_READ_STRIP_ALPHA_SUPPORTED 1490| 1.25k| if ((png_ptr->transformations & PNG_STRIP_ALPHA) != 0 && ------------------ | | 676| 1.25k|#define PNG_STRIP_ALPHA 0x40000U ------------------ | Branch (1490:8): [True: 0, False: 1.25k] ------------------ 1491| 0| (png_ptr->transformations & PNG_COMPOSE) == 0) ------------------ | | 665| 0|#define PNG_COMPOSE 0x0080U /* Was PNG_BACKGROUND */ ------------------ | Branch (1491:8): [True: 0, False: 0] ------------------ 1492| 0| { 1493| | /* Stripping the alpha channel happens immediately after the 'expand' 1494| | * transformations, before all other transformation, so it cancels out 1495| | * the alpha handling. It has the side effect negating the effect of 1496| | * PNG_EXPAND_tRNS too: 1497| | */ 1498| 0| png_ptr->transformations &= ~(PNG_BACKGROUND_EXPAND | PNG_ENCODE_ALPHA | ------------------ | | 666| 0|#define PNG_BACKGROUND_EXPAND 0x0100U ------------------ png_ptr->transformations &= ~(PNG_BACKGROUND_EXPAND | PNG_ENCODE_ALPHA | ------------------ | | 682| 0|#define PNG_ENCODE_ALPHA 0x800000U /* Added to libpng-1.5.4 */ ------------------ 1499| 0| PNG_EXPAND_tRNS); ------------------ | | 684| 0|#define PNG_EXPAND_tRNS 0x2000000U /* Added to libpng-1.2.9 */ ------------------ 1500| 0| png_ptr->flags &= ~PNG_FLAG_OPTIMIZE_ALPHA; ------------------ | | 708| 0|#define PNG_FLAG_OPTIMIZE_ALPHA 0x2000U /* Added to libpng-1.5.4 */ ------------------ 1501| | 1502| | /* Kill the tRNS chunk itself too. Prior to 1.5.4 this did not happen 1503| | * so transparency information would remain just so long as it wasn't 1504| | * expanded. This produces unexpected API changes if the set of things 1505| | * that do PNG_EXPAND_tRNS changes (perfectly possible given the 1506| | * documentation - which says ask for what you want, accept what you 1507| | * get.) This makes the behavior consistent from 1.5.4: 1508| | */ 1509| 0| png_ptr->num_trans = 0; 1510| 0| } 1511| 1.25k|#endif /* STRIP_ALPHA supported, no COMPOSE */ 1512| | 1513| 1.25k|#ifdef PNG_READ_ALPHA_MODE_SUPPORTED 1514| | /* If the screen gamma is about 1.0 then the OPTIMIZE_ALPHA and ENCODE_ALPHA 1515| | * settings will have no effect. 1516| | */ 1517| 1.25k| if (png_gamma_significant(png_ptr->screen_gamma) == 0) ------------------ | | 91| 1.25k|#define png_gamma_significant OSS_FUZZ_png_gamma_significant ------------------ | Branch (1517:8): [True: 1.25k, False: 0] ------------------ 1518| 1.25k| { 1519| 1.25k| png_ptr->transformations &= ~PNG_ENCODE_ALPHA; ------------------ | | 682| 1.25k|#define PNG_ENCODE_ALPHA 0x800000U /* Added to libpng-1.5.4 */ ------------------ 1520| 1.25k| png_ptr->flags &= ~PNG_FLAG_OPTIMIZE_ALPHA; ------------------ | | 708| 1.25k|#define PNG_FLAG_OPTIMIZE_ALPHA 0x2000U /* Added to libpng-1.5.4 */ ------------------ 1521| 1.25k| } 1522| 1.25k|#endif 1523| | 1524| 1.25k|#ifdef PNG_READ_RGB_TO_GRAY_SUPPORTED 1525| | /* Make sure the coefficients for the rgb to gray conversion are set 1526| | * appropriately. 1527| | */ 1528| 1.25k| if ((png_ptr->transformations & PNG_RGB_TO_GRAY) != 0) ------------------ | | 681| 1.25k|#define PNG_RGB_TO_GRAY 0x600000U /* two bits, RGB_TO_GRAY_ERR|WARN */ ------------------ | Branch (1528:8): [True: 0, False: 1.25k] ------------------ 1529| 0| png_set_rgb_coefficients(png_ptr); ------------------ | | 98| 0|#define png_set_rgb_coefficients OSS_FUZZ_png_set_rgb_coefficients ------------------ 1530| 1.25k|#endif 1531| | 1532| 1.25k|#ifdef PNG_READ_GRAY_TO_RGB_SUPPORTED 1533| 1.25k|#if defined(PNG_READ_EXPAND_SUPPORTED) && defined(PNG_READ_BACKGROUND_SUPPORTED) 1534| | /* Detect gray background and attempt to enable optimization for 1535| | * gray --> RGB case. 1536| | * 1537| | * Note: if PNG_BACKGROUND_EXPAND is set and color_type is either RGB or 1538| | * RGB_ALPHA (in which case need_expand is superfluous anyway), the 1539| | * background color might actually be gray yet not be flagged as such. 1540| | * This is not a problem for the current code, which uses 1541| | * PNG_BACKGROUND_IS_GRAY only to decide when to do the 1542| | * png_do_gray_to_rgb() transformation. 1543| | * 1544| | * TODO: this code needs to be revised to avoid the complexity and 1545| | * interdependencies. The color type of the background should be recorded in 1546| | * png_set_background, along with the bit depth, then the code has a record 1547| | * of exactly what color space the background is currently in. 1548| | */ 1549| 1.25k| if ((png_ptr->transformations & PNG_BACKGROUND_EXPAND) != 0) ------------------ | | 666| 1.25k|#define PNG_BACKGROUND_EXPAND 0x0100U ------------------ | Branch (1549:8): [True: 0, False: 1.25k] ------------------ 1550| 0| { 1551| | /* PNG_BACKGROUND_EXPAND: the background is in the file color space, so if 1552| | * the file was grayscale the background value is gray. 1553| | */ 1554| 0| if ((png_ptr->color_type & PNG_COLOR_MASK_COLOR) == 0) ------------------ | | 662| 0|#define PNG_COLOR_MASK_COLOR 2 ------------------ | Branch (1554:11): [True: 0, False: 0] ------------------ 1555| 0| png_ptr->mode |= PNG_BACKGROUND_IS_GRAY; ------------------ | | 651| 0|#define PNG_BACKGROUND_IS_GRAY 0x800U ------------------ 1556| 0| } 1557| | 1558| 1.25k| else if ((png_ptr->transformations & PNG_COMPOSE) != 0) ------------------ | | 665| 1.25k|#define PNG_COMPOSE 0x0080U /* Was PNG_BACKGROUND */ ------------------ | Branch (1558:13): [True: 1.25k, False: 0] ------------------ 1559| 1.25k| { 1560| | /* PNG_COMPOSE: png_set_background was called with need_expand false, 1561| | * so the color is in the color space of the output or png_set_alpha_mode 1562| | * was called and the color is black. Ignore RGB_TO_GRAY because that 1563| | * happens before GRAY_TO_RGB. 1564| | */ 1565| 1.25k| if ((png_ptr->transformations & PNG_GRAY_TO_RGB) != 0) ------------------ | | 672| 1.25k|#define PNG_GRAY_TO_RGB 0x4000U ------------------ | Branch (1565:11): [True: 0, False: 1.25k] ------------------ 1566| 0| { 1567| 0| if (png_ptr->background.red == png_ptr->background.green && ------------------ | Branch (1567:14): [True: 0, False: 0] ------------------ 1568| 0| png_ptr->background.red == png_ptr->background.blue) ------------------ | Branch (1568:14): [True: 0, False: 0] ------------------ 1569| 0| { 1570| 0| png_ptr->mode |= PNG_BACKGROUND_IS_GRAY; ------------------ | | 651| 0|#define PNG_BACKGROUND_IS_GRAY 0x800U ------------------ 1571| 0| png_ptr->background.gray = png_ptr->background.red; 1572| 0| } 1573| 0| } 1574| 1.25k| } 1575| 1.25k|#endif /* READ_EXPAND && READ_BACKGROUND */ 1576| 1.25k|#endif /* READ_GRAY_TO_RGB */ 1577| | 1578| | /* For indexed PNG data (PNG_COLOR_TYPE_PALETTE) many of the transformations 1579| | * can be performed directly on the palette, and some (such as rgb to gray) 1580| | * can be optimized inside the palette. This is particularly true of the 1581| | * composite (background and alpha) stuff, which can be pretty much all done 1582| | * in the palette even if the result is expanded to RGB or gray afterward. 1583| | * 1584| | * NOTE: this is Not Yet Implemented, the code behaves as in 1.5.1 and 1585| | * earlier and the palette stuff is actually handled on the first row. This 1586| | * leads to the reported bug that the palette returned by png_get_PLTE is not 1587| | * updated. 1588| | */ 1589| 1.25k| if (png_ptr->color_type == PNG_COLOR_TYPE_PALETTE) ------------------ | | 667| 1.25k|#define PNG_COLOR_TYPE_PALETTE (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_PALETTE) | | ------------------ | | | | 662| 1.25k|#define PNG_COLOR_MASK_COLOR 2 | | ------------------ | | #define PNG_COLOR_TYPE_PALETTE (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_PALETTE) | | ------------------ | | | | 661| 1.25k|#define PNG_COLOR_MASK_PALETTE 1 | | ------------------ ------------------ | Branch (1589:8): [True: 74, False: 1.17k] ------------------ 1590| 74| png_init_palette_transformations(png_ptr); 1591| | 1592| 1.17k| else 1593| 1.17k| png_init_rgb_transformations(png_ptr); 1594| | 1595| 1.25k|#if defined(PNG_READ_BACKGROUND_SUPPORTED) && \ 1596| 1.25k| defined(PNG_READ_EXPAND_16_SUPPORTED) 1597| 1.25k| if ((png_ptr->transformations & PNG_EXPAND_16) != 0 && ------------------ | | 667| 1.25k|#define PNG_EXPAND_16 0x0200U /* Added to libpng 1.5.2 */ ------------------ | Branch (1597:8): [True: 0, False: 1.25k] ------------------ 1598| 0| (png_ptr->transformations & PNG_COMPOSE) != 0 && ------------------ | | 665| 0|#define PNG_COMPOSE 0x0080U /* Was PNG_BACKGROUND */ ------------------ | Branch (1598:8): [True: 0, False: 0] ------------------ 1599| 0| (png_ptr->transformations & PNG_BACKGROUND_EXPAND) == 0 && ------------------ | | 666| 0|#define PNG_BACKGROUND_EXPAND 0x0100U ------------------ | Branch (1599:8): [True: 0, False: 0] ------------------ 1600| 0| png_ptr->bit_depth != 16) ------------------ | Branch (1600:8): [True: 0, False: 0] ------------------ 1601| 0| { 1602| | /* TODO: fix this. Because the expand_16 operation is after the compose 1603| | * handling the background color must be 8, not 16, bits deep, but the 1604| | * application will supply a 16-bit value so reduce it here. 1605| | * 1606| | * The PNG_BACKGROUND_EXPAND code above does not expand to 16 bits at 1607| | * present, so that case is ok (until do_expand_16 is moved.) 1608| | * 1609| | * NOTE: this discards the low 16 bits of the user supplied background 1610| | * color, but until expand_16 works properly there is no choice! 1611| | */ 1612| 0|# define CHOP(x) (x)=((png_uint_16)PNG_DIV257(x)) 1613| 0| CHOP(png_ptr->background.red); ------------------ | | 1612| 0|# define CHOP(x) (x)=((png_uint_16)PNG_DIV257(x)) | | ------------------ | | | | 751| 0|#define PNG_DIV257(v16) PNG_DIV65535((png_uint_32)(v16) * 255) | | | | ------------------ | | | | | | 750| 0|#define PNG_DIV65535(v24) (((v24) + 32895) >> 16) | | | | ------------------ | | ------------------ ------------------ 1614| 0| CHOP(png_ptr->background.green); ------------------ | | 1612| 0|# define CHOP(x) (x)=((png_uint_16)PNG_DIV257(x)) | | ------------------ | | | | 751| 0|#define PNG_DIV257(v16) PNG_DIV65535((png_uint_32)(v16) * 255) | | | | ------------------ | | | | | | 750| 0|#define PNG_DIV65535(v24) (((v24) + 32895) >> 16) | | | | ------------------ | | ------------------ ------------------ 1615| 0| CHOP(png_ptr->background.blue); ------------------ | | 1612| 0|# define CHOP(x) (x)=((png_uint_16)PNG_DIV257(x)) | | ------------------ | | | | 751| 0|#define PNG_DIV257(v16) PNG_DIV65535((png_uint_32)(v16) * 255) | | | | ------------------ | | | | | | 750| 0|#define PNG_DIV65535(v24) (((v24) + 32895) >> 16) | | | | ------------------ | | ------------------ ------------------ 1616| 0| CHOP(png_ptr->background.gray); ------------------ | | 1612| 0|# define CHOP(x) (x)=((png_uint_16)PNG_DIV257(x)) | | ------------------ | | | | 751| 0|#define PNG_DIV257(v16) PNG_DIV65535((png_uint_32)(v16) * 255) | | | | ------------------ | | | | | | 750| 0|#define PNG_DIV65535(v24) (((v24) + 32895) >> 16) | | | | ------------------ | | ------------------ ------------------ 1617| 0|# undef CHOP 1618| 0| } 1619| 1.25k|#endif /* READ_BACKGROUND && READ_EXPAND_16 */ 1620| | 1621| 1.25k|#if defined(PNG_READ_BACKGROUND_SUPPORTED) && \ 1622| 1.25k| (defined(PNG_READ_SCALE_16_TO_8_SUPPORTED) || \ 1623| 1.25k| defined(PNG_READ_STRIP_16_TO_8_SUPPORTED)) 1624| 1.25k| if ((png_ptr->transformations & (PNG_16_TO_8|PNG_SCALE_16_TO_8)) != 0 && ------------------ | | 668| 1.25k|#define PNG_16_TO_8 0x0400U /* Becomes 'chop' in 1.5.4 */ ------------------ if ((png_ptr->transformations & (PNG_16_TO_8|PNG_SCALE_16_TO_8)) != 0 && ------------------ | | 685| 1.25k|#define PNG_SCALE_16_TO_8 0x4000000U /* Added to libpng-1.5.4 */ ------------------ | Branch (1624:8): [True: 493, False: 757] ------------------ 1625| 493| (png_ptr->transformations & PNG_COMPOSE) != 0 && ------------------ | | 665| 493|#define PNG_COMPOSE 0x0080U /* Was PNG_BACKGROUND */ ------------------ | Branch (1625:8): [True: 385, False: 108] ------------------ 1626| 385| (png_ptr->transformations & PNG_BACKGROUND_EXPAND) == 0 && ------------------ | | 666| 385|#define PNG_BACKGROUND_EXPAND 0x0100U ------------------ | Branch (1626:8): [True: 385, False: 0] ------------------ 1627| 385| png_ptr->bit_depth == 16) ------------------ | Branch (1627:8): [True: 385, False: 0] ------------------ 1628| 385| { 1629| | /* On the other hand, if a 16-bit file is to be reduced to 8-bits per 1630| | * component this will also happen after PNG_COMPOSE and so the background 1631| | * color must be pre-expanded here. 1632| | * 1633| | * TODO: fix this too. 1634| | */ 1635| 385| png_ptr->background.red = (png_uint_16)(png_ptr->background.red * 257); 1636| 385| png_ptr->background.green = 1637| 385| (png_uint_16)(png_ptr->background.green * 257); 1638| 385| png_ptr->background.blue = (png_uint_16)(png_ptr->background.blue * 257); 1639| 385| png_ptr->background.gray = (png_uint_16)(png_ptr->background.gray * 257); 1640| 385| } 1641| 1.25k|#endif 1642| | 1643| | /* NOTE: below 'PNG_READ_ALPHA_MODE_SUPPORTED' is presumed to also enable the 1644| | * background support (see the comments in scripts/pnglibconf.dfa), this 1645| | * allows pre-multiplication of the alpha channel to be implemented as 1646| | * compositing on black. This is probably sub-optimal and has been done in 1647| | * 1.5.4 betas simply to enable external critique and testing (i.e. to 1648| | * implement the new API quickly, without lots of internal changes.) 1649| | */ 1650| | 1651| 1.25k|#ifdef PNG_READ_GAMMA_SUPPORTED 1652| 1.25k|# ifdef PNG_READ_BACKGROUND_SUPPORTED 1653| | /* Includes ALPHA_MODE */ 1654| 1.25k| png_ptr->background_1 = png_ptr->background; 1655| 1.25k|# endif 1656| | 1657| | /* This needs to change - in the palette image case a whole set of tables are 1658| | * built when it would be quicker to just calculate the correct value for 1659| | * each palette entry directly. Also, the test is too tricky - why check 1660| | * PNG_RGB_TO_GRAY if PNG_GAMMA is not set? The answer seems to be that 1661| | * PNG_GAMMA is cancelled even if the gamma is known? The test excludes the 1662| | * PNG_COMPOSE case, so apparently if there is no *overall* gamma correction 1663| | * the gamma tables will not be built even if composition is required on a 1664| | * gamma encoded value. 1665| | * 1666| | * In 1.5.4 this is addressed below by an additional check on the individual 1667| | * file gamma - if it is not 1.0 both RGB_TO_GRAY and COMPOSE need the 1668| | * tables. 1669| | */ 1670| 1.25k| if ((png_ptr->transformations & PNG_GAMMA) != 0 || ------------------ | | 671| 1.25k|#define PNG_GAMMA 0x2000U ------------------ | Branch (1670:8): [True: 456, False: 794] ------------------ 1671| 794| ((png_ptr->transformations & PNG_RGB_TO_GRAY) != 0 && ------------------ | | 681| 794|#define PNG_RGB_TO_GRAY 0x600000U /* two bits, RGB_TO_GRAY_ERR|WARN */ ------------------ | Branch (1671:9): [True: 0, False: 794] ------------------ 1672| 0| (png_gamma_significant(png_ptr->file_gamma) != 0 || ------------------ | | 91| 0|#define png_gamma_significant OSS_FUZZ_png_gamma_significant ------------------ | Branch (1672:10): [True: 0, False: 0] ------------------ 1673| 0| png_gamma_significant(png_ptr->screen_gamma) != 0)) || ------------------ | | 91| 0|#define png_gamma_significant OSS_FUZZ_png_gamma_significant ------------------ | Branch (1673:10): [True: 0, False: 0] ------------------ 1674| 794| ((png_ptr->transformations & PNG_COMPOSE) != 0 && ------------------ | | 665| 794|#define PNG_COMPOSE 0x0080U /* Was PNG_BACKGROUND */ ------------------ | Branch (1674:10): [True: 461, False: 333] ------------------ 1675| 461| (png_gamma_significant(png_ptr->file_gamma) != 0 || ------------------ | | 91| 461|#define png_gamma_significant OSS_FUZZ_png_gamma_significant ------------------ | Branch (1675:11): [True: 0, False: 461] ------------------ 1676| 461| png_gamma_significant(png_ptr->screen_gamma) != 0 ------------------ | | 91| 461|#define png_gamma_significant OSS_FUZZ_png_gamma_significant ------------------ | Branch (1676:11): [True: 0, False: 461] ------------------ 1677| 461|# ifdef PNG_READ_BACKGROUND_SUPPORTED 1678| 461| || (png_ptr->background_gamma_type == PNG_BACKGROUND_GAMMA_UNIQUE && ------------------ | | 1362| 922|# define PNG_BACKGROUND_GAMMA_UNIQUE 3 ------------------ | Branch (1678:14): [True: 0, False: 461] ------------------ 1679| 0| png_gamma_significant(png_ptr->background_gamma) != 0) ------------------ | | 91| 0|#define png_gamma_significant OSS_FUZZ_png_gamma_significant ------------------ | Branch (1679:12): [True: 0, False: 0] ------------------ 1680| 461|# endif 1681| 794| )) || ((png_ptr->transformations & PNG_ENCODE_ALPHA) != 0 && ------------------ | | 682| 794|#define PNG_ENCODE_ALPHA 0x800000U /* Added to libpng-1.5.4 */ ------------------ | Branch (1681:16): [True: 0, False: 794] ------------------ 1682| 0| png_gamma_significant(png_ptr->screen_gamma) != 0)) ------------------ | | 91| 0|#define png_gamma_significant OSS_FUZZ_png_gamma_significant ------------------ | Branch (1682:8): [True: 0, False: 0] ------------------ 1683| 456| { 1684| 456| png_build_gamma_table(png_ptr, png_ptr->bit_depth); ------------------ | | 97| 456|#define png_build_gamma_table OSS_FUZZ_png_build_gamma_table ------------------ 1685| | 1686| 456|#ifdef PNG_READ_BACKGROUND_SUPPORTED 1687| 456| if ((png_ptr->transformations & PNG_COMPOSE) != 0) ------------------ | | 665| 456|#define PNG_COMPOSE 0x0080U /* Was PNG_BACKGROUND */ ------------------ | Branch (1687:11): [True: 370, False: 86] ------------------ 1688| 370| { 1689| | /* Issue a warning about this combination: because RGB_TO_GRAY is 1690| | * optimized to do the gamma transform if present yet do_background has 1691| | * to do the same thing if both options are set a 1692| | * double-gamma-correction happens. This is true in all versions of 1693| | * libpng to date. 1694| | */ 1695| 370| if ((png_ptr->transformations & PNG_RGB_TO_GRAY) != 0) ------------------ | | 681| 370|#define PNG_RGB_TO_GRAY 0x600000U /* two bits, RGB_TO_GRAY_ERR|WARN */ ------------------ | Branch (1695:14): [True: 0, False: 370] ------------------ 1696| 0| png_warning(png_ptr, ------------------ | | 450| 0|#define png_warning OSS_FUZZ_png_warning ------------------ 1697| 0| "libpng does not support gamma+background+rgb_to_gray"); 1698| | 1699| 370| if ((png_ptr->color_type == PNG_COLOR_TYPE_PALETTE) != 0) ------------------ | | 667| 370|#define PNG_COLOR_TYPE_PALETTE (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_PALETTE) | | ------------------ | | | | 662| 370|#define PNG_COLOR_MASK_COLOR 2 | | ------------------ | | #define PNG_COLOR_TYPE_PALETTE (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_PALETTE) | | ------------------ | | | | 661| 370|#define PNG_COLOR_MASK_PALETTE 1 | | ------------------ ------------------ | Branch (1699:14): [True: 14, False: 356] ------------------ 1700| 14| { 1701| | /* We don't get to here unless there is a tRNS chunk with non-opaque 1702| | * entries - see the checking code at the start of this function. 1703| | */ 1704| 14| png_color back, back_1; 1705| 14| png_colorp palette = png_ptr->palette; 1706| 14| int num_palette = png_ptr->num_palette; 1707| 14| int i; 1708| 14| if (png_ptr->background_gamma_type == PNG_BACKGROUND_GAMMA_FILE) ------------------ | | 1361| 14|# define PNG_BACKGROUND_GAMMA_FILE 2 ------------------ | Branch (1708:17): [True: 14, False: 0] ------------------ 1709| 14| { 1710| | 1711| 14| back.red = png_ptr->gamma_table[png_ptr->background.red]; 1712| 14| back.green = png_ptr->gamma_table[png_ptr->background.green]; 1713| 14| back.blue = png_ptr->gamma_table[png_ptr->background.blue]; 1714| | 1715| 14| back_1.red = png_ptr->gamma_to_1[png_ptr->background.red]; 1716| 14| back_1.green = png_ptr->gamma_to_1[png_ptr->background.green]; 1717| 14| back_1.blue = png_ptr->gamma_to_1[png_ptr->background.blue]; 1718| 14| } 1719| 0| else 1720| 0| { 1721| 0| png_fixed_point g, gs; 1722| | 1723| 0| switch (png_ptr->background_gamma_type) 1724| 0| { 1725| 0| case PNG_BACKGROUND_GAMMA_SCREEN: ------------------ | | 1360| 0|# define PNG_BACKGROUND_GAMMA_SCREEN 1 ------------------ | Branch (1725:19): [True: 0, False: 0] ------------------ 1726| 0| g = (png_ptr->screen_gamma); 1727| 0| gs = PNG_FP_1; ------------------ | | 654| 0|#define PNG_FP_1 100000 ------------------ 1728| 0| break; 1729| | 1730| 0| case PNG_BACKGROUND_GAMMA_FILE: ------------------ | | 1361| 0|# define PNG_BACKGROUND_GAMMA_FILE 2 ------------------ | Branch (1730:19): [True: 0, False: 0] ------------------ 1731| 0| g = png_reciprocal(png_ptr->file_gamma); ------------------ | | 89| 0|#define png_reciprocal OSS_FUZZ_png_reciprocal ------------------ 1732| 0| gs = png_reciprocal2(png_ptr->file_gamma, ------------------ | | 90| 0|#define png_reciprocal2 OSS_FUZZ_png_reciprocal2 ------------------ 1733| 0| png_ptr->screen_gamma); 1734| 0| break; 1735| | 1736| 0| case PNG_BACKGROUND_GAMMA_UNIQUE: ------------------ | | 1362| 0|# define PNG_BACKGROUND_GAMMA_UNIQUE 3 ------------------ | Branch (1736:19): [True: 0, False: 0] ------------------ 1737| 0| g = png_reciprocal(png_ptr->background_gamma); ------------------ | | 89| 0|#define png_reciprocal OSS_FUZZ_png_reciprocal ------------------ 1738| 0| gs = png_reciprocal2(png_ptr->background_gamma, ------------------ | | 90| 0|#define png_reciprocal2 OSS_FUZZ_png_reciprocal2 ------------------ 1739| 0| png_ptr->screen_gamma); 1740| 0| break; 1741| 0| default: ------------------ | Branch (1741:19): [True: 0, False: 0] ------------------ 1742| 0| g = PNG_FP_1; /* back_1 */ ------------------ | | 654| 0|#define PNG_FP_1 100000 ------------------ 1743| 0| gs = PNG_FP_1; /* back */ ------------------ | | 654| 0|#define PNG_FP_1 100000 ------------------ 1744| 0| break; 1745| 0| } 1746| | 1747| 0| if (png_gamma_significant(gs) != 0) ------------------ | | 91| 0|#define png_gamma_significant OSS_FUZZ_png_gamma_significant ------------------ | Branch (1747:20): [True: 0, False: 0] ------------------ 1748| 0| { 1749| 0| back.red = png_gamma_8bit_correct(png_ptr->background.red, ------------------ | | 95| 0|#define png_gamma_8bit_correct OSS_FUZZ_png_gamma_8bit_correct ------------------ 1750| 0| gs); 1751| 0| back.green = png_gamma_8bit_correct(png_ptr->background.green, ------------------ | | 95| 0|#define png_gamma_8bit_correct OSS_FUZZ_png_gamma_8bit_correct ------------------ 1752| 0| gs); 1753| 0| back.blue = png_gamma_8bit_correct(png_ptr->background.blue, ------------------ | | 95| 0|#define png_gamma_8bit_correct OSS_FUZZ_png_gamma_8bit_correct ------------------ 1754| 0| gs); 1755| 0| } 1756| | 1757| 0| else 1758| 0| { 1759| 0| back.red = (png_byte)png_ptr->background.red; 1760| 0| back.green = (png_byte)png_ptr->background.green; 1761| 0| back.blue = (png_byte)png_ptr->background.blue; 1762| 0| } 1763| | 1764| 0| if (png_gamma_significant(g) != 0) ------------------ | | 91| 0|#define png_gamma_significant OSS_FUZZ_png_gamma_significant ------------------ | Branch (1764:20): [True: 0, False: 0] ------------------ 1765| 0| { 1766| 0| back_1.red = png_gamma_8bit_correct(png_ptr->background.red, ------------------ | | 95| 0|#define png_gamma_8bit_correct OSS_FUZZ_png_gamma_8bit_correct ------------------ 1767| 0| g); 1768| 0| back_1.green = png_gamma_8bit_correct( ------------------ | | 95| 0|#define png_gamma_8bit_correct OSS_FUZZ_png_gamma_8bit_correct ------------------ 1769| 0| png_ptr->background.green, g); 1770| 0| back_1.blue = png_gamma_8bit_correct(png_ptr->background.blue, ------------------ | | 95| 0|#define png_gamma_8bit_correct OSS_FUZZ_png_gamma_8bit_correct ------------------ 1771| 0| g); 1772| 0| } 1773| | 1774| 0| else 1775| 0| { 1776| 0| back_1.red = (png_byte)png_ptr->background.red; 1777| 0| back_1.green = (png_byte)png_ptr->background.green; 1778| 0| back_1.blue = (png_byte)png_ptr->background.blue; 1779| 0| } 1780| 0| } 1781| | 1782| 587| for (i = 0; i < num_palette; i++) ------------------ | Branch (1782:25): [True: 573, False: 14] ------------------ 1783| 573| { 1784| 573| if (i < (int)png_ptr->num_trans && ------------------ | Branch (1784:20): [True: 313, False: 260] ------------------ 1785| 313| png_ptr->trans_alpha[i] != 0xff) ------------------ | Branch (1785:20): [True: 307, False: 6] ------------------ 1786| 307| { 1787| 307| if (png_ptr->trans_alpha[i] == 0) ------------------ | Branch (1787:23): [True: 22, False: 285] ------------------ 1788| 22| { 1789| 22| palette[i] = back; 1790| 22| } 1791| 285| else /* if (png_ptr->trans_alpha[i] != 0xff) */ 1792| 285| { 1793| 285| if ((png_ptr->flags & PNG_FLAG_OPTIMIZE_ALPHA) != 0) ------------------ | | 708| 285|#define PNG_FLAG_OPTIMIZE_ALPHA 0x2000U /* Added to libpng-1.5.4 */ ------------------ | Branch (1793:26): [True: 0, False: 285] ------------------ 1794| 0| { 1795| | /* Premultiply only: 1796| | * component = round((component * alpha) / 255) 1797| | */ 1798| 0| png_uint_32 component; 1799| | 1800| 0| component = png_ptr->gamma_to_1[palette[i].red]; 1801| 0| component = 1802| 0| (component * png_ptr->trans_alpha[i] + 128) / 255; 1803| 0| palette[i].red = png_ptr->gamma_from_1[component]; 1804| | 1805| 0| component = png_ptr->gamma_to_1[palette[i].green]; 1806| 0| component = 1807| 0| (component * png_ptr->trans_alpha[i] + 128) / 255; 1808| 0| palette[i].green = png_ptr->gamma_from_1[component]; 1809| | 1810| 0| component = png_ptr->gamma_to_1[palette[i].blue]; 1811| 0| component = 1812| 0| (component * png_ptr->trans_alpha[i] + 128) / 255; 1813| 0| palette[i].blue = png_ptr->gamma_from_1[component]; 1814| 0| } 1815| 285| else 1816| 285| { 1817| | /* Composite with background color: 1818| | * component = 1819| | * alpha * component + (1 - alpha) * background 1820| | */ 1821| 285| png_byte v, w; 1822| | 1823| 285| v = png_ptr->gamma_to_1[palette[i].red]; 1824| 285| png_composite(w, v, ------------------ | | 2752| 285| { \ | | 2753| 285| png_uint_16 temp = (png_uint_16)((png_uint_16)(fg) \ | | 2754| 285| * (png_uint_16)(alpha) \ | | 2755| 285| + (png_uint_16)(bg)*(png_uint_16)(255 \ | | 2756| 285| - (png_uint_16)(alpha)) + 128); \ | | 2757| 285| (composite) = (png_byte)(((temp + (temp >> 8)) >> 8) & 0xff); \ | | 2758| 285| } ------------------ 1825| 285| png_ptr->trans_alpha[i], back_1.red); 1826| 285| palette[i].red = png_ptr->gamma_from_1[w]; 1827| | 1828| 285| v = png_ptr->gamma_to_1[palette[i].green]; 1829| 285| png_composite(w, v, ------------------ | | 2752| 285| { \ | | 2753| 285| png_uint_16 temp = (png_uint_16)((png_uint_16)(fg) \ | | 2754| 285| * (png_uint_16)(alpha) \ | | 2755| 285| + (png_uint_16)(bg)*(png_uint_16)(255 \ | | 2756| 285| - (png_uint_16)(alpha)) + 128); \ | | 2757| 285| (composite) = (png_byte)(((temp + (temp >> 8)) >> 8) & 0xff); \ | | 2758| 285| } ------------------ 1830| 285| png_ptr->trans_alpha[i], back_1.green); 1831| 285| palette[i].green = png_ptr->gamma_from_1[w]; 1832| | 1833| 285| v = png_ptr->gamma_to_1[palette[i].blue]; 1834| 285| png_composite(w, v, ------------------ | | 2752| 285| { \ | | 2753| 285| png_uint_16 temp = (png_uint_16)((png_uint_16)(fg) \ | | 2754| 285| * (png_uint_16)(alpha) \ | | 2755| 285| + (png_uint_16)(bg)*(png_uint_16)(255 \ | | 2756| 285| - (png_uint_16)(alpha)) + 128); \ | | 2757| 285| (composite) = (png_byte)(((temp + (temp >> 8)) >> 8) & 0xff); \ | | 2758| 285| } ------------------ 1835| 285| png_ptr->trans_alpha[i], back_1.blue); 1836| 285| palette[i].blue = png_ptr->gamma_from_1[w]; 1837| 285| } 1838| 285| } 1839| 307| } 1840| 266| else 1841| 266| { 1842| 266| palette[i].red = png_ptr->gamma_table[palette[i].red]; 1843| 266| palette[i].green = png_ptr->gamma_table[palette[i].green]; 1844| 266| palette[i].blue = png_ptr->gamma_table[palette[i].blue]; 1845| 266| } 1846| 573| } 1847| | 1848| | /* Prevent the transformations being done again. 1849| | * 1850| | * NOTE: this is highly dubious; it removes the transformations in 1851| | * place. This seems inconsistent with the general treatment of the 1852| | * transformations elsewhere. 1853| | */ 1854| 14| png_ptr->transformations &= ~(PNG_COMPOSE | PNG_GAMMA); ------------------ | | 665| 14|#define PNG_COMPOSE 0x0080U /* Was PNG_BACKGROUND */ ------------------ png_ptr->transformations &= ~(PNG_COMPOSE | PNG_GAMMA); ------------------ | | 671| 14|#define PNG_GAMMA 0x2000U ------------------ 1855| 14| png_ptr->flags &= ~PNG_FLAG_OPTIMIZE_ALPHA; ------------------ | | 708| 14|#define PNG_FLAG_OPTIMIZE_ALPHA 0x2000U /* Added to libpng-1.5.4 */ ------------------ 1856| 14| } /* color_type == PNG_COLOR_TYPE_PALETTE */ 1857| | 1858| | /* if (png_ptr->background_gamma_type!=PNG_BACKGROUND_GAMMA_UNKNOWN) */ 1859| 356| else /* color_type != PNG_COLOR_TYPE_PALETTE */ 1860| 356| { 1861| 356| int gs_sig, g_sig; 1862| 356| png_fixed_point g = PNG_FP_1; /* Correction to linear */ ------------------ | | 654| 356|#define PNG_FP_1 100000 ------------------ 1863| 356| png_fixed_point gs = PNG_FP_1; /* Correction to screen */ ------------------ | | 654| 356|#define PNG_FP_1 100000 ------------------ 1864| | 1865| 356| switch (png_ptr->background_gamma_type) 1866| 356| { 1867| 0| case PNG_BACKGROUND_GAMMA_SCREEN: ------------------ | | 1360| 0|# define PNG_BACKGROUND_GAMMA_SCREEN 1 ------------------ | Branch (1867:16): [True: 0, False: 356] ------------------ 1868| 0| g = png_ptr->screen_gamma; 1869| | /* gs = PNG_FP_1; */ 1870| 0| break; 1871| | 1872| 356| case PNG_BACKGROUND_GAMMA_FILE: ------------------ | | 1361| 356|# define PNG_BACKGROUND_GAMMA_FILE 2 ------------------ | Branch (1872:16): [True: 356, False: 0] ------------------ 1873| 356| g = png_reciprocal(png_ptr->file_gamma); ------------------ | | 89| 356|#define png_reciprocal OSS_FUZZ_png_reciprocal ------------------ 1874| 356| gs = png_reciprocal2(png_ptr->file_gamma, ------------------ | | 90| 356|#define png_reciprocal2 OSS_FUZZ_png_reciprocal2 ------------------ 1875| 356| png_ptr->screen_gamma); 1876| 356| break; 1877| | 1878| 0| case PNG_BACKGROUND_GAMMA_UNIQUE: ------------------ | | 1362| 0|# define PNG_BACKGROUND_GAMMA_UNIQUE 3 ------------------ | Branch (1878:16): [True: 0, False: 356] ------------------ 1879| 0| g = png_reciprocal(png_ptr->background_gamma); ------------------ | | 89| 0|#define png_reciprocal OSS_FUZZ_png_reciprocal ------------------ 1880| 0| gs = png_reciprocal2(png_ptr->background_gamma, ------------------ | | 90| 0|#define png_reciprocal2 OSS_FUZZ_png_reciprocal2 ------------------ 1881| 0| png_ptr->screen_gamma); 1882| 0| break; 1883| | 1884| 0| default: ------------------ | Branch (1884:16): [True: 0, False: 356] ------------------ 1885| 0| png_error(png_ptr, "invalid background gamma type"); ------------------ | | 252| 0|#define png_error OSS_FUZZ_png_error ------------------ 1886| 356| } 1887| | 1888| 356| g_sig = png_gamma_significant(g); ------------------ | | 91| 356|#define png_gamma_significant OSS_FUZZ_png_gamma_significant ------------------ 1889| 356| gs_sig = png_gamma_significant(gs); ------------------ | | 91| 356|#define png_gamma_significant OSS_FUZZ_png_gamma_significant ------------------ 1890| | 1891| 356| if (g_sig != 0) ------------------ | Branch (1891:17): [True: 356, False: 0] ------------------ 1892| 356| png_ptr->background_1.gray = png_gamma_correct(png_ptr, ------------------ | | 93| 356|#define png_gamma_correct OSS_FUZZ_png_gamma_correct ------------------ 1893| 356| png_ptr->background.gray, g); 1894| | 1895| 356| if (gs_sig != 0) ------------------ | Branch (1895:17): [True: 356, False: 0] ------------------ 1896| 356| png_ptr->background.gray = png_gamma_correct(png_ptr, ------------------ | | 93| 356|#define png_gamma_correct OSS_FUZZ_png_gamma_correct ------------------ 1897| 356| png_ptr->background.gray, gs); 1898| | 1899| 356| if ((png_ptr->background.red != png_ptr->background.green) || ------------------ | Branch (1899:17): [True: 0, False: 356] ------------------ 1900| 356| (png_ptr->background.red != png_ptr->background.blue) || ------------------ | Branch (1900:17): [True: 0, False: 356] ------------------ 1901| 356| (png_ptr->background.red != png_ptr->background.gray)) ------------------ | Branch (1901:17): [True: 0, False: 356] ------------------ 1902| 0| { 1903| | /* RGB or RGBA with color background */ 1904| 0| if (g_sig != 0) ------------------ | Branch (1904:20): [True: 0, False: 0] ------------------ 1905| 0| { 1906| 0| png_ptr->background_1.red = png_gamma_correct(png_ptr, ------------------ | | 93| 0|#define png_gamma_correct OSS_FUZZ_png_gamma_correct ------------------ 1907| 0| png_ptr->background.red, g); 1908| | 1909| 0| png_ptr->background_1.green = png_gamma_correct(png_ptr, ------------------ | | 93| 0|#define png_gamma_correct OSS_FUZZ_png_gamma_correct ------------------ 1910| 0| png_ptr->background.green, g); 1911| | 1912| 0| png_ptr->background_1.blue = png_gamma_correct(png_ptr, ------------------ | | 93| 0|#define png_gamma_correct OSS_FUZZ_png_gamma_correct ------------------ 1913| 0| png_ptr->background.blue, g); 1914| 0| } 1915| | 1916| 0| if (gs_sig != 0) ------------------ | Branch (1916:20): [True: 0, False: 0] ------------------ 1917| 0| { 1918| 0| png_ptr->background.red = png_gamma_correct(png_ptr, ------------------ | | 93| 0|#define png_gamma_correct OSS_FUZZ_png_gamma_correct ------------------ 1919| 0| png_ptr->background.red, gs); 1920| | 1921| 0| png_ptr->background.green = png_gamma_correct(png_ptr, ------------------ | | 93| 0|#define png_gamma_correct OSS_FUZZ_png_gamma_correct ------------------ 1922| 0| png_ptr->background.green, gs); 1923| | 1924| 0| png_ptr->background.blue = png_gamma_correct(png_ptr, ------------------ | | 93| 0|#define png_gamma_correct OSS_FUZZ_png_gamma_correct ------------------ 1925| 0| png_ptr->background.blue, gs); 1926| 0| } 1927| 0| } 1928| | 1929| 356| else 1930| 356| { 1931| | /* GRAY, GRAY ALPHA, RGB, or RGBA with gray background */ 1932| 356| png_ptr->background_1.red = png_ptr->background_1.green 1933| 356| = png_ptr->background_1.blue = png_ptr->background_1.gray; 1934| | 1935| 356| png_ptr->background.red = png_ptr->background.green 1936| 356| = png_ptr->background.blue = png_ptr->background.gray; 1937| 356| } 1938| | 1939| | /* The background is now in screen gamma: */ 1940| 356| png_ptr->background_gamma_type = PNG_BACKGROUND_GAMMA_SCREEN; ------------------ | | 1360| 356|# define PNG_BACKGROUND_GAMMA_SCREEN 1 ------------------ 1941| 356| } /* color_type != PNG_COLOR_TYPE_PALETTE */ 1942| 370| }/* png_ptr->transformations & PNG_BACKGROUND */ 1943| | 1944| 86| else 1945| | /* Transformation does not include PNG_BACKGROUND */ 1946| 86|#endif /* READ_BACKGROUND */ 1947| 86| if (png_ptr->color_type == PNG_COLOR_TYPE_PALETTE ------------------ | | 667| 172|#define PNG_COLOR_TYPE_PALETTE (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_PALETTE) | | ------------------ | | | | 662| 86|#define PNG_COLOR_MASK_COLOR 2 | | ------------------ | | #define PNG_COLOR_TYPE_PALETTE (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_PALETTE) | | ------------------ | | | | 661| 86|#define PNG_COLOR_MASK_PALETTE 1 | | ------------------ ------------------ | Branch (1947:11): [True: 7, False: 79] ------------------ 1948| 7|#ifdef PNG_READ_RGB_TO_GRAY_SUPPORTED 1949| | /* RGB_TO_GRAY needs to have non-gamma-corrected values! */ 1950| 7| && ((png_ptr->transformations & PNG_EXPAND) == 0 || ------------------ | | 670| 7|#define PNG_EXPAND 0x1000U ------------------ | Branch (1950:14): [True: 7, False: 0] ------------------ 1951| 0| (png_ptr->transformations & PNG_RGB_TO_GRAY) == 0) ------------------ | | 681| 0|#define PNG_RGB_TO_GRAY 0x600000U /* two bits, RGB_TO_GRAY_ERR|WARN */ ------------------ | Branch (1951:10): [True: 0, False: 0] ------------------ 1952| 86|#endif 1953| 86| ) 1954| 7| { 1955| 7| png_colorp palette = png_ptr->palette; 1956| 7| int num_palette = png_ptr->num_palette; 1957| 7| int i; 1958| | 1959| | /* NOTE: there are other transformations that should probably be in 1960| | * here too. 1961| | */ 1962| 670| for (i = 0; i < num_palette; i++) ------------------ | Branch (1962:22): [True: 663, False: 7] ------------------ 1963| 663| { 1964| 663| palette[i].red = png_ptr->gamma_table[palette[i].red]; 1965| 663| palette[i].green = png_ptr->gamma_table[palette[i].green]; 1966| 663| palette[i].blue = png_ptr->gamma_table[palette[i].blue]; 1967| 663| } 1968| | 1969| | /* Done the gamma correction. */ 1970| 7| png_ptr->transformations &= ~PNG_GAMMA; ------------------ | | 671| 7|#define PNG_GAMMA 0x2000U ------------------ 1971| 7| } /* color_type == PALETTE && !PNG_BACKGROUND transformation */ 1972| 456| } 1973| 794|#ifdef PNG_READ_BACKGROUND_SUPPORTED 1974| 794| else 1975| 794|#endif 1976| 794|#endif /* READ_GAMMA */ 1977| | 1978| 794|#ifdef PNG_READ_BACKGROUND_SUPPORTED 1979| | /* No GAMMA transformation (see the hanging else 4 lines above) */ 1980| 794| if ((png_ptr->transformations & PNG_COMPOSE) != 0 && ------------------ | | 665| 794|#define PNG_COMPOSE 0x0080U /* Was PNG_BACKGROUND */ ------------------ | Branch (1980:8): [True: 461, False: 333] ------------------ 1981| 461| (png_ptr->color_type == PNG_COLOR_TYPE_PALETTE)) ------------------ | | 667| 461|#define PNG_COLOR_TYPE_PALETTE (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_PALETTE) | | ------------------ | | | | 662| 461|#define PNG_COLOR_MASK_COLOR 2 | | ------------------ | | #define PNG_COLOR_TYPE_PALETTE (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_PALETTE) | | ------------------ | | | | 661| 461|#define PNG_COLOR_MASK_PALETTE 1 | | ------------------ ------------------ | Branch (1981:8): [True: 15, False: 446] ------------------ 1982| 15| { 1983| 15| int i; 1984| 15| int istop = (int)png_ptr->num_trans; 1985| 15| png_color back; 1986| 15| png_colorp palette = png_ptr->palette; 1987| | 1988| 15| back.red = (png_byte)png_ptr->background.red; 1989| 15| back.green = (png_byte)png_ptr->background.green; 1990| 15| back.blue = (png_byte)png_ptr->background.blue; 1991| | 1992| 585| for (i = 0; i < istop; i++) ------------------ | Branch (1992:19): [True: 570, False: 15] ------------------ 1993| 570| { 1994| 570| if (png_ptr->trans_alpha[i] == 0) ------------------ | Branch (1994:14): [True: 107, False: 463] ------------------ 1995| 107| { 1996| 107| palette[i] = back; 1997| 107| } 1998| | 1999| 463| else if (png_ptr->trans_alpha[i] != 0xff) ------------------ | Branch (1999:19): [True: 359, False: 104] ------------------ 2000| 359| { 2001| | /* The png_composite() macro is defined in png.h */ 2002| 359| png_composite(palette[i].red, palette[i].red, ------------------ | | 2752| 359| { \ | | 2753| 359| png_uint_16 temp = (png_uint_16)((png_uint_16)(fg) \ | | 2754| 359| * (png_uint_16)(alpha) \ | | 2755| 359| + (png_uint_16)(bg)*(png_uint_16)(255 \ | | 2756| 359| - (png_uint_16)(alpha)) + 128); \ | | 2757| 359| (composite) = (png_byte)(((temp + (temp >> 8)) >> 8) & 0xff); \ | | 2758| 359| } ------------------ 2003| 359| png_ptr->trans_alpha[i], back.red); 2004| | 2005| 359| png_composite(palette[i].green, palette[i].green, ------------------ | | 2752| 359| { \ | | 2753| 359| png_uint_16 temp = (png_uint_16)((png_uint_16)(fg) \ | | 2754| 359| * (png_uint_16)(alpha) \ | | 2755| 359| + (png_uint_16)(bg)*(png_uint_16)(255 \ | | 2756| 359| - (png_uint_16)(alpha)) + 128); \ | | 2757| 359| (composite) = (png_byte)(((temp + (temp >> 8)) >> 8) & 0xff); \ | | 2758| 359| } ------------------ 2006| 359| png_ptr->trans_alpha[i], back.green); 2007| | 2008| 359| png_composite(palette[i].blue, palette[i].blue, ------------------ | | 2752| 359| { \ | | 2753| 359| png_uint_16 temp = (png_uint_16)((png_uint_16)(fg) \ | | 2754| 359| * (png_uint_16)(alpha) \ | | 2755| 359| + (png_uint_16)(bg)*(png_uint_16)(255 \ | | 2756| 359| - (png_uint_16)(alpha)) + 128); \ | | 2757| 359| (composite) = (png_byte)(((temp + (temp >> 8)) >> 8) & 0xff); \ | | 2758| 359| } ------------------ 2009| 359| png_ptr->trans_alpha[i], back.blue); 2010| 359| } 2011| 570| } 2012| | 2013| 15| png_ptr->transformations &= ~PNG_COMPOSE; ------------------ | | 665| 15|#define PNG_COMPOSE 0x0080U /* Was PNG_BACKGROUND */ ------------------ 2014| 15| } 2015| 1.25k|#endif /* READ_BACKGROUND */ 2016| | 2017| 1.25k|#ifdef PNG_READ_SHIFT_SUPPORTED 2018| 1.25k| if ((png_ptr->transformations & PNG_SHIFT) != 0 && ------------------ | | 661| 1.25k|#define PNG_SHIFT 0x0008U ------------------ | Branch (2018:8): [True: 0, False: 1.25k] ------------------ 2019| 0| (png_ptr->transformations & PNG_EXPAND) == 0 && ------------------ | | 670| 0|#define PNG_EXPAND 0x1000U ------------------ | Branch (2019:8): [True: 0, False: 0] ------------------ 2020| 0| (png_ptr->color_type == PNG_COLOR_TYPE_PALETTE)) ------------------ | | 667| 0|#define PNG_COLOR_TYPE_PALETTE (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_PALETTE) | | ------------------ | | | | 662| 0|#define PNG_COLOR_MASK_COLOR 2 | | ------------------ | | #define PNG_COLOR_TYPE_PALETTE (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_PALETTE) | | ------------------ | | | | 661| 0|#define PNG_COLOR_MASK_PALETTE 1 | | ------------------ ------------------ | Branch (2020:8): [True: 0, False: 0] ------------------ 2021| 0| { 2022| 0| int i; 2023| 0| int istop = png_ptr->num_palette; 2024| 0| int shift = 8 - png_ptr->sig_bit.red; 2025| | 2026| 0| png_ptr->transformations &= ~PNG_SHIFT; ------------------ | | 661| 0|#define PNG_SHIFT 0x0008U ------------------ 2027| | 2028| | /* significant bits can be in the range 1 to 7 for a meaningful result, if 2029| | * the number of significant bits is 0 then no shift is done (this is an 2030| | * error condition which is silently ignored.) 2031| | */ 2032| 0| if (shift > 0 && shift < 8) ------------------ | Branch (2032:11): [True: 0, False: 0] | Branch (2032:24): [True: 0, False: 0] ------------------ 2033| 0| for (i=0; ipalette[i].red; 2036| | 2037| 0| component >>= shift; 2038| 0| png_ptr->palette[i].red = (png_byte)component; 2039| 0| } 2040| | 2041| 0| shift = 8 - png_ptr->sig_bit.green; 2042| 0| if (shift > 0 && shift < 8) ------------------ | Branch (2042:11): [True: 0, False: 0] | Branch (2042:24): [True: 0, False: 0] ------------------ 2043| 0| for (i=0; ipalette[i].green; 2046| | 2047| 0| component >>= shift; 2048| 0| png_ptr->palette[i].green = (png_byte)component; 2049| 0| } 2050| | 2051| 0| shift = 8 - png_ptr->sig_bit.blue; 2052| 0| if (shift > 0 && shift < 8) ------------------ | Branch (2052:11): [True: 0, False: 0] | Branch (2052:24): [True: 0, False: 0] ------------------ 2053| 0| for (i=0; ipalette[i].blue; 2056| | 2057| 0| component >>= shift; 2058| 0| png_ptr->palette[i].blue = (png_byte)component; 2059| 0| } 2060| 0| } 2061| 1.25k|#endif /* READ_SHIFT */ 2062| 1.25k|} OSS_FUZZ_png_read_transform_info: 2070| 1.25k|{ 2071| 1.25k| png_debug(1, "in png_read_transform_info"); ------------------ | | 145| 1.25k|# define png_debug(l, m) ((void)0) ------------------ 2072| | 2073| 1.25k| if (info_ptr->color_type == PNG_COLOR_TYPE_PALETTE && ------------------ | | 667| 2.50k|#define PNG_COLOR_TYPE_PALETTE (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_PALETTE) | | ------------------ | | | | 662| 1.25k|#define PNG_COLOR_MASK_COLOR 2 | | ------------------ | | #define PNG_COLOR_TYPE_PALETTE (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_PALETTE) | | ------------------ | | | | 661| 1.25k|#define PNG_COLOR_MASK_PALETTE 1 | | ------------------ ------------------ | Branch (2073:8): [True: 74, False: 1.17k] ------------------ 2074| 74| info_ptr->palette != NULL && png_ptr->palette != NULL) ------------------ | Branch (2074:8): [True: 74, False: 0] | Branch (2074:37): [True: 74, False: 0] ------------------ 2075| 74| { 2076| | /* Sync info_ptr->palette with png_ptr->palette, which may 2077| | * have been modified by png_init_read_transformations 2078| | * (e.g. for gamma correction or background compositing). 2079| | */ 2080| 74| memcpy(info_ptr->palette, png_ptr->palette, 2081| 74| PNG_MAX_PALETTE_LENGTH * (sizeof (png_color))); ------------------ | | 723| 74|#define PNG_MAX_PALETTE_LENGTH 256 ------------------ 2082| 74| } 2083| | 2084| 1.25k|#ifdef PNG_READ_EXPAND_SUPPORTED 2085| 1.25k| if ((png_ptr->transformations & PNG_EXPAND) != 0) ------------------ | | 670| 1.25k|#define PNG_EXPAND 0x1000U ------------------ | Branch (2085:8): [True: 0, False: 1.25k] ------------------ 2086| 0| { 2087| 0| if (info_ptr->color_type == PNG_COLOR_TYPE_PALETTE) ------------------ | | 667| 0|#define PNG_COLOR_TYPE_PALETTE (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_PALETTE) | | ------------------ | | | | 662| 0|#define PNG_COLOR_MASK_COLOR 2 | | ------------------ | | #define PNG_COLOR_TYPE_PALETTE (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_PALETTE) | | ------------------ | | | | 661| 0|#define PNG_COLOR_MASK_PALETTE 1 | | ------------------ ------------------ | Branch (2087:11): [True: 0, False: 0] ------------------ 2088| 0| { 2089| | /* This check must match what actually happens in 2090| | * png_do_expand_palette; if it ever checks the tRNS chunk to see if 2091| | * it is all opaque we must do the same (at present it does not.) 2092| | */ 2093| 0| if (png_ptr->num_trans > 0) ------------------ | Branch (2093:14): [True: 0, False: 0] ------------------ 2094| 0| info_ptr->color_type = PNG_COLOR_TYPE_RGB_ALPHA; ------------------ | | 669| 0|#define PNG_COLOR_TYPE_RGB_ALPHA (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_ALPHA) | | ------------------ | | | | 662| 0|#define PNG_COLOR_MASK_COLOR 2 | | ------------------ | | #define PNG_COLOR_TYPE_RGB_ALPHA (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_ALPHA) | | ------------------ | | | | 663| 0|#define PNG_COLOR_MASK_ALPHA 4 | | ------------------ ------------------ 2095| | 2096| 0| else 2097| 0| info_ptr->color_type = PNG_COLOR_TYPE_RGB; ------------------ | | 668| 0|#define PNG_COLOR_TYPE_RGB (PNG_COLOR_MASK_COLOR) | | ------------------ | | | | 662| 0|#define PNG_COLOR_MASK_COLOR 2 | | ------------------ ------------------ 2098| | 2099| 0| info_ptr->bit_depth = 8; 2100| 0| info_ptr->num_trans = 0; 2101| | 2102| 0| if (png_ptr->palette == NULL) ------------------ | Branch (2102:14): [True: 0, False: 0] ------------------ 2103| 0| png_error (png_ptr, "Palette is NULL in indexed image"); ------------------ | | 252| 0|#define png_error OSS_FUZZ_png_error ------------------ 2104| 0| } 2105| 0| else 2106| 0| { 2107| 0| if (png_ptr->num_trans != 0) ------------------ | Branch (2107:14): [True: 0, False: 0] ------------------ 2108| 0| { 2109| 0| if ((png_ptr->transformations & PNG_EXPAND_tRNS) != 0) ------------------ | | 684| 0|#define PNG_EXPAND_tRNS 0x2000000U /* Added to libpng-1.2.9 */ ------------------ | Branch (2109:17): [True: 0, False: 0] ------------------ 2110| 0| info_ptr->color_type |= PNG_COLOR_MASK_ALPHA; ------------------ | | 663| 0|#define PNG_COLOR_MASK_ALPHA 4 ------------------ 2111| 0| } 2112| 0| if (info_ptr->bit_depth < 8) ------------------ | Branch (2112:14): [True: 0, False: 0] ------------------ 2113| 0| info_ptr->bit_depth = 8; 2114| | 2115| 0| info_ptr->num_trans = 0; 2116| 0| } 2117| 0| } 2118| 1.25k|#endif 2119| | 2120| 1.25k|#if defined(PNG_READ_BACKGROUND_SUPPORTED) ||\ 2121| 1.25k| defined(PNG_READ_ALPHA_MODE_SUPPORTED) 2122| | /* The following is almost certainly wrong unless the background value is in 2123| | * the screen space! 2124| | */ 2125| 1.25k| if ((png_ptr->transformations & PNG_COMPOSE) != 0) ------------------ | | 665| 1.25k|#define PNG_COMPOSE 0x0080U /* Was PNG_BACKGROUND */ ------------------ | Branch (2125:8): [True: 802, False: 448] ------------------ 2126| 802| info_ptr->background = png_ptr->background; 2127| 1.25k|#endif 2128| | 2129| 1.25k|#ifdef PNG_READ_GAMMA_SUPPORTED 2130| | /* The following used to be conditional on PNG_GAMMA (prior to 1.5.4), 2131| | * however it seems that the code in png_init_read_transformations, which has 2132| | * been called before this from png_read_update_info->png_read_start_row 2133| | * sometimes does the gamma transform and cancels the flag. 2134| | * 2135| | * TODO: this is confusing. It only changes the result of png_get_gAMA and, 2136| | * yes, it does return the value that the transformed data effectively has 2137| | * but does any app really understand this? 2138| | */ 2139| 1.25k| info_ptr->gamma = png_ptr->file_gamma; 2140| 1.25k|#endif 2141| | 2142| 1.25k| if (info_ptr->bit_depth == 16) ------------------ | Branch (2142:8): [True: 493, False: 757] ------------------ 2143| 493| { 2144| 493|# ifdef PNG_READ_16BIT_SUPPORTED 2145| 493|# ifdef PNG_READ_SCALE_16_TO_8_SUPPORTED 2146| 493| if ((png_ptr->transformations & PNG_SCALE_16_TO_8) != 0) ------------------ | | 685| 493|#define PNG_SCALE_16_TO_8 0x4000000U /* Added to libpng-1.5.4 */ ------------------ | Branch (2146:14): [True: 493, False: 0] ------------------ 2147| 493| info_ptr->bit_depth = 8; 2148| 493|# endif 2149| | 2150| 493|# ifdef PNG_READ_STRIP_16_TO_8_SUPPORTED 2151| 493| if ((png_ptr->transformations & PNG_16_TO_8) != 0) ------------------ | | 668| 493|#define PNG_16_TO_8 0x0400U /* Becomes 'chop' in 1.5.4 */ ------------------ | Branch (2151:14): [True: 0, False: 493] ------------------ 2152| 0| info_ptr->bit_depth = 8; 2153| 493|# endif 2154| | 2155| |# else 2156| | /* No 16-bit support: force chopping 16-bit input down to 8, in this case 2157| | * the app program can chose if both APIs are available by setting the 2158| | * correct scaling to use. 2159| | */ 2160| |# ifdef PNG_READ_STRIP_16_TO_8_SUPPORTED 2161| | /* For compatibility with previous versions use the strip method by 2162| | * default. This code works because if PNG_SCALE_16_TO_8 is already 2163| | * set the code below will do that in preference to the chop. 2164| | */ 2165| | png_ptr->transformations |= PNG_16_TO_8; 2166| | info_ptr->bit_depth = 8; 2167| |# else 2168| | 2169| |# ifdef PNG_READ_SCALE_16_TO_8_SUPPORTED 2170| | png_ptr->transformations |= PNG_SCALE_16_TO_8; 2171| | info_ptr->bit_depth = 8; 2172| |# else 2173| | 2174| | CONFIGURATION ERROR: you must enable at least one 16 to 8 method 2175| |# endif 2176| |# endif 2177| |#endif /* !READ_16BIT */ 2178| 493| } 2179| | 2180| 1.25k|#ifdef PNG_READ_GRAY_TO_RGB_SUPPORTED 2181| 1.25k| if ((png_ptr->transformations & PNG_GRAY_TO_RGB) != 0) ------------------ | | 672| 1.25k|#define PNG_GRAY_TO_RGB 0x4000U ------------------ | Branch (2181:8): [True: 0, False: 1.25k] ------------------ 2182| 0| info_ptr->color_type = (png_byte)(info_ptr->color_type | 2183| 0| PNG_COLOR_MASK_COLOR); ------------------ | | 662| 0|#define PNG_COLOR_MASK_COLOR 2 ------------------ 2184| 1.25k|#endif 2185| | 2186| 1.25k|#ifdef PNG_READ_RGB_TO_GRAY_SUPPORTED 2187| 1.25k| if ((png_ptr->transformations & PNG_RGB_TO_GRAY) != 0) ------------------ | | 681| 1.25k|#define PNG_RGB_TO_GRAY 0x600000U /* two bits, RGB_TO_GRAY_ERR|WARN */ ------------------ | Branch (2187:8): [True: 0, False: 1.25k] ------------------ 2188| 0| info_ptr->color_type = (png_byte)(info_ptr->color_type & 2189| 0| ~PNG_COLOR_MASK_COLOR); ------------------ | | 662| 0|#define PNG_COLOR_MASK_COLOR 2 ------------------ 2190| 1.25k|#endif 2191| | 2192| 1.25k|#ifdef PNG_READ_QUANTIZE_SUPPORTED 2193| 1.25k| if ((png_ptr->transformations & PNG_QUANTIZE) != 0) ------------------ | | 664| 1.25k|#define PNG_QUANTIZE 0x0040U ------------------ | Branch (2193:8): [True: 505, False: 745] ------------------ 2194| 505| { 2195| 505| if (((info_ptr->color_type == PNG_COLOR_TYPE_RGB) || ------------------ | | 668| 505|#define PNG_COLOR_TYPE_RGB (PNG_COLOR_MASK_COLOR) | | ------------------ | | | | 662| 505|#define PNG_COLOR_MASK_COLOR 2 | | ------------------ ------------------ | Branch (2195:12): [True: 320, False: 185] ------------------ 2196| 185| (info_ptr->color_type == PNG_COLOR_TYPE_RGB_ALPHA)) && ------------------ | | 669| 185|#define PNG_COLOR_TYPE_RGB_ALPHA (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_ALPHA) | | ------------------ | | | | 662| 185|#define PNG_COLOR_MASK_COLOR 2 | | ------------------ | | #define PNG_COLOR_TYPE_RGB_ALPHA (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_ALPHA) | | ------------------ | | | | 663| 185|#define PNG_COLOR_MASK_ALPHA 4 | | ------------------ ------------------ | Branch (2196:11): [True: 185, False: 0] ------------------ 2197| 505| png_ptr->palette_lookup != 0 && info_ptr->bit_depth == 8) ------------------ | Branch (2197:11): [True: 0, False: 505] | Branch (2197:43): [True: 0, False: 0] ------------------ 2198| 0| { 2199| 0| info_ptr->color_type = PNG_COLOR_TYPE_PALETTE; ------------------ | | 667| 0|#define PNG_COLOR_TYPE_PALETTE (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_PALETTE) | | ------------------ | | | | 662| 0|#define PNG_COLOR_MASK_COLOR 2 | | ------------------ | | #define PNG_COLOR_TYPE_PALETTE (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_PALETTE) | | ------------------ | | | | 661| 0|#define PNG_COLOR_MASK_PALETTE 1 | | ------------------ ------------------ 2200| 0| } 2201| 505| } 2202| 1.25k|#endif 2203| | 2204| 1.25k|#ifdef PNG_READ_EXPAND_16_SUPPORTED 2205| 1.25k| if ((png_ptr->transformations & PNG_EXPAND_16) != 0 && ------------------ | | 667| 1.25k|#define PNG_EXPAND_16 0x0200U /* Added to libpng 1.5.2 */ ------------------ | Branch (2205:8): [True: 0, False: 1.25k] ------------------ 2206| 0| info_ptr->bit_depth == 8 && ------------------ | Branch (2206:8): [True: 0, False: 0] ------------------ 2207| 0| info_ptr->color_type != PNG_COLOR_TYPE_PALETTE) ------------------ | | 667| 0|#define PNG_COLOR_TYPE_PALETTE (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_PALETTE) | | ------------------ | | | | 662| 0|#define PNG_COLOR_MASK_COLOR 2 | | ------------------ | | #define PNG_COLOR_TYPE_PALETTE (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_PALETTE) | | ------------------ | | | | 661| 0|#define PNG_COLOR_MASK_PALETTE 1 | | ------------------ ------------------ | Branch (2207:8): [True: 0, False: 0] ------------------ 2208| 0| { 2209| 0| info_ptr->bit_depth = 16; 2210| 0| } 2211| 1.25k|#endif 2212| | 2213| 1.25k|#ifdef PNG_READ_PACK_SUPPORTED 2214| 1.25k| if ((png_ptr->transformations & PNG_PACK) != 0 && ------------------ | | 660| 1.25k|#define PNG_PACK 0x0004U ------------------ | Branch (2214:8): [True: 334, False: 916] ------------------ 2215| 334| (info_ptr->bit_depth < 8)) ------------------ | Branch (2215:8): [True: 334, False: 0] ------------------ 2216| 334| info_ptr->bit_depth = 8; 2217| 1.25k|#endif 2218| | 2219| 1.25k| if (info_ptr->color_type == PNG_COLOR_TYPE_PALETTE) ------------------ | | 667| 1.25k|#define PNG_COLOR_TYPE_PALETTE (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_PALETTE) | | ------------------ | | | | 662| 1.25k|#define PNG_COLOR_MASK_COLOR 2 | | ------------------ | | #define PNG_COLOR_TYPE_PALETTE (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_PALETTE) | | ------------------ | | | | 661| 1.25k|#define PNG_COLOR_MASK_PALETTE 1 | | ------------------ ------------------ | Branch (2219:8): [True: 74, False: 1.17k] ------------------ 2220| 74| info_ptr->channels = 1; 2221| | 2222| 1.17k| else if ((info_ptr->color_type & PNG_COLOR_MASK_COLOR) != 0) ------------------ | | 662| 1.17k|#define PNG_COLOR_MASK_COLOR 2 ------------------ | Branch (2222:13): [True: 505, False: 671] ------------------ 2223| 505| info_ptr->channels = 3; 2224| | 2225| 671| else 2226| 671| info_ptr->channels = 1; 2227| | 2228| 1.25k|#ifdef PNG_READ_STRIP_ALPHA_SUPPORTED 2229| 1.25k| if ((png_ptr->transformations & PNG_STRIP_ALPHA) != 0) ------------------ | | 676| 1.25k|#define PNG_STRIP_ALPHA 0x40000U ------------------ | Branch (2229:8): [True: 0, False: 1.25k] ------------------ 2230| 0| { 2231| 0| info_ptr->color_type = (png_byte)(info_ptr->color_type & 2232| 0| ~PNG_COLOR_MASK_ALPHA); ------------------ | | 663| 0|#define PNG_COLOR_MASK_ALPHA 4 ------------------ 2233| 0| info_ptr->num_trans = 0; 2234| 0| } 2235| 1.25k|#endif 2236| | 2237| 1.25k| if ((info_ptr->color_type & PNG_COLOR_MASK_ALPHA) != 0) ------------------ | | 663| 1.25k|#define PNG_COLOR_MASK_ALPHA 4 ------------------ | Branch (2237:8): [True: 341, False: 909] ------------------ 2238| 341| info_ptr->channels++; 2239| | 2240| 1.25k|#ifdef PNG_READ_FILLER_SUPPORTED 2241| | /* STRIP_ALPHA and FILLER allowed: MASK_ALPHA bit stripped above */ 2242| 1.25k| if ((png_ptr->transformations & PNG_FILLER) != 0 && ------------------ | | 673| 1.25k|#define PNG_FILLER 0x8000U ------------------ | Branch (2242:8): [True: 0, False: 1.25k] ------------------ 2243| 0| (info_ptr->color_type == PNG_COLOR_TYPE_RGB || ------------------ | | 668| 0|#define PNG_COLOR_TYPE_RGB (PNG_COLOR_MASK_COLOR) | | ------------------ | | | | 662| 0|#define PNG_COLOR_MASK_COLOR 2 | | ------------------ ------------------ | Branch (2243:9): [True: 0, False: 0] ------------------ 2244| 0| info_ptr->color_type == PNG_COLOR_TYPE_GRAY)) ------------------ | | 666| 0|#define PNG_COLOR_TYPE_GRAY 0 ------------------ | Branch (2244:8): [True: 0, False: 0] ------------------ 2245| 0| { 2246| 0| info_ptr->channels++; 2247| | /* If adding a true alpha channel not just filler */ 2248| 0| if ((png_ptr->transformations & PNG_ADD_ALPHA) != 0) ------------------ | | 683| 0|#define PNG_ADD_ALPHA 0x1000000U /* Added to libpng-1.2.7 */ ------------------ | Branch (2248:11): [True: 0, False: 0] ------------------ 2249| 0| info_ptr->color_type |= PNG_COLOR_MASK_ALPHA; ------------------ | | 663| 0|#define PNG_COLOR_MASK_ALPHA 4 ------------------ 2250| 0| } 2251| 1.25k|#endif 2252| | 2253| 1.25k|#if defined(PNG_USER_TRANSFORM_PTR_SUPPORTED) && \ 2254| 1.25k|defined(PNG_READ_USER_TRANSFORM_SUPPORTED) 2255| 1.25k| if ((png_ptr->transformations & PNG_USER_TRANSFORM) != 0) ------------------ | | 678| 1.25k|#define PNG_USER_TRANSFORM 0x100000U ------------------ | Branch (2255:8): [True: 0, False: 1.25k] ------------------ 2256| 0| { 2257| 0| if (png_ptr->user_transform_depth != 0) ------------------ | Branch (2257:11): [True: 0, False: 0] ------------------ 2258| 0| info_ptr->bit_depth = png_ptr->user_transform_depth; 2259| | 2260| 0| if (png_ptr->user_transform_channels != 0) ------------------ | Branch (2260:11): [True: 0, False: 0] ------------------ 2261| 0| info_ptr->channels = png_ptr->user_transform_channels; 2262| 0| } 2263| 1.25k|#endif 2264| | 2265| 1.25k| info_ptr->pixel_depth = (png_byte)(info_ptr->channels * 2266| 1.25k| info_ptr->bit_depth); 2267| | 2268| 1.25k| info_ptr->rowbytes = PNG_ROWBYTES(info_ptr->pixel_depth, info_ptr->width); ------------------ | | 755| 1.25k| ((pixel_bits) >= 8 ? \ | | ------------------ | | | Branch (755:6): [True: 1.25k, False: 0] | | ------------------ | | 756| 1.25k| ((size_t)(width) * (((size_t)(pixel_bits)) >> 3)) : \ | | 757| 1.25k| (( ((size_t)(width) * ((size_t)(pixel_bits))) + 7) >> 3) ) ------------------ 2269| | 2270| | /* Adding in 1.5.4: cache the above value in png_struct so that we can later 2271| | * check in png_rowbytes that the user buffer won't get overwritten. Note 2272| | * that the field is not always set - if png_read_update_info isn't called 2273| | * the application has to either not do any transforms or get the calculation 2274| | * right itself. 2275| | */ 2276| 1.25k| png_ptr->info_rowbytes = info_ptr->rowbytes; 2277| | 2278| |#ifndef PNG_READ_EXPAND_SUPPORTED 2279| | if (png_ptr != NULL) 2280| | return; 2281| |#endif 2282| 1.25k|} OSS_FUZZ_png_do_read_transformations: 4881| 9.77k|{ 4882| 9.77k| png_debug(1, "in png_do_read_transformations"); ------------------ | | 145| 9.77k|# define png_debug(l, m) ((void)0) ------------------ 4883| | 4884| 9.77k| if (png_ptr->row_buf == NULL) ------------------ | Branch (4884:8): [True: 0, False: 9.77k] ------------------ 4885| 0| { 4886| | /* Prior to 1.5.4 this output row/pass where the NULL pointer is, but this 4887| | * error is incredibly rare and incredibly easy to debug without this 4888| | * information. 4889| | */ 4890| 0| png_error(png_ptr, "NULL row buffer"); ------------------ | | 252| 0|#define png_error OSS_FUZZ_png_error ------------------ 4891| 0| } 4892| | 4893| | /* The following is debugging; prior to 1.5.4 the code was never compiled in; 4894| | * in 1.5.4 PNG_FLAG_DETECT_UNINITIALIZED was added and the macro 4895| | * PNG_WARN_UNINITIALIZED_ROW removed. In 1.6 the new flag is set only for 4896| | * all transformations, however in practice the ROW_INIT always gets done on 4897| | * demand, if necessary. 4898| | */ 4899| 9.77k| if ((png_ptr->flags & PNG_FLAG_DETECT_UNINITIALIZED) != 0 && ------------------ | | 709| 9.77k|#define PNG_FLAG_DETECT_UNINITIALIZED 0x4000U /* Added to libpng-1.5.4 */ ------------------ | Branch (4899:8): [True: 9.77k, False: 0] ------------------ 4900| 9.77k| (png_ptr->flags & PNG_FLAG_ROW_INIT) == 0) ------------------ | | 701| 9.77k|#define PNG_FLAG_ROW_INIT 0x0040U ------------------ | Branch (4900:8): [True: 0, False: 9.77k] ------------------ 4901| 0| { 4902| | /* Application has failed to call either png_read_start_image() or 4903| | * png_read_update_info() after setting transforms that expand pixels. 4904| | * This check added to libpng-1.2.19 (but not enabled until 1.5.4). 4905| | */ 4906| 0| png_error(png_ptr, "Uninitialized row"); ------------------ | | 252| 0|#define png_error OSS_FUZZ_png_error ------------------ 4907| 0| } 4908| | 4909| 9.77k|#ifdef PNG_READ_EXPAND_SUPPORTED 4910| 9.77k| if ((png_ptr->transformations & PNG_EXPAND) != 0) ------------------ | | 670| 9.77k|#define PNG_EXPAND 0x1000U ------------------ | Branch (4910:8): [True: 0, False: 9.77k] ------------------ 4911| 0| { 4912| 0| if (row_info->color_type == PNG_COLOR_TYPE_PALETTE) ------------------ | | 667| 0|#define PNG_COLOR_TYPE_PALETTE (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_PALETTE) | | ------------------ | | | | 662| 0|#define PNG_COLOR_MASK_COLOR 2 | | ------------------ | | #define PNG_COLOR_TYPE_PALETTE (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_PALETTE) | | ------------------ | | | | 661| 0|#define PNG_COLOR_MASK_PALETTE 1 | | ------------------ ------------------ | Branch (4912:11): [True: 0, False: 0] ------------------ 4913| 0| { 4914| |#ifdef PNG_ARM_NEON_INTRINSICS_AVAILABLE 4915| | if ((png_ptr->num_trans > 0) && (png_ptr->bit_depth == 8)) 4916| | { 4917| | if (png_ptr->riffled_palette == NULL) 4918| | { 4919| | /* Initialize the accelerated palette expansion. */ 4920| | png_ptr->riffled_palette = 4921| | (png_bytep)png_malloc(png_ptr, 256 * 4); 4922| | png_riffle_palette_neon(png_ptr); 4923| | } 4924| | } 4925| |#endif 4926| 0| png_do_expand_palette(png_ptr, row_info, png_ptr->row_buf + 1, 4927| 0| png_ptr->palette, png_ptr->trans_alpha, png_ptr->num_trans); 4928| 0| } 4929| | 4930| 0| else 4931| 0| { 4932| 0| if (png_ptr->num_trans != 0 && ------------------ | Branch (4932:14): [True: 0, False: 0] ------------------ 4933| 0| (png_ptr->transformations & PNG_EXPAND_tRNS) != 0) ------------------ | | 684| 0|#define PNG_EXPAND_tRNS 0x2000000U /* Added to libpng-1.2.9 */ ------------------ | Branch (4933:14): [True: 0, False: 0] ------------------ 4934| 0| png_do_expand(row_info, png_ptr->row_buf + 1, 4935| 0| &(png_ptr->trans_color)); 4936| | 4937| 0| else 4938| 0| png_do_expand(row_info, png_ptr->row_buf + 1, NULL); 4939| 0| } 4940| 0| } 4941| 9.77k|#endif 4942| | 4943| 9.77k|#ifdef PNG_READ_STRIP_ALPHA_SUPPORTED 4944| 9.77k| if ((png_ptr->transformations & PNG_STRIP_ALPHA) != 0 && ------------------ | | 676| 9.77k|#define PNG_STRIP_ALPHA 0x40000U ------------------ | Branch (4944:8): [True: 0, False: 9.77k] ------------------ 4945| 0| (png_ptr->transformations & PNG_COMPOSE) == 0 && ------------------ | | 665| 0|#define PNG_COMPOSE 0x0080U /* Was PNG_BACKGROUND */ ------------------ | Branch (4945:8): [True: 0, False: 0] ------------------ 4946| 0| (row_info->color_type == PNG_COLOR_TYPE_RGB_ALPHA || ------------------ | | 669| 0|#define PNG_COLOR_TYPE_RGB_ALPHA (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_ALPHA) | | ------------------ | | | | 662| 0|#define PNG_COLOR_MASK_COLOR 2 | | ------------------ | | #define PNG_COLOR_TYPE_RGB_ALPHA (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_ALPHA) | | ------------------ | | | | 663| 0|#define PNG_COLOR_MASK_ALPHA 4 | | ------------------ ------------------ | Branch (4946:9): [True: 0, False: 0] ------------------ 4947| 0| row_info->color_type == PNG_COLOR_TYPE_GRAY_ALPHA)) ------------------ | | 670| 0|#define PNG_COLOR_TYPE_GRAY_ALPHA (PNG_COLOR_MASK_ALPHA) | | ------------------ | | | | 663| 0|#define PNG_COLOR_MASK_ALPHA 4 | | ------------------ ------------------ | Branch (4947:8): [True: 0, False: 0] ------------------ 4948| 0| png_do_strip_channel(row_info, png_ptr->row_buf + 1, ------------------ | | 44| 0|#define png_do_strip_channel OSS_FUZZ_png_do_strip_channel ------------------ 4949| 0| 0 /* at_start == false, because SWAP_ALPHA happens later */); 4950| 9.77k|#endif 4951| | 4952| 9.77k|#ifdef PNG_READ_RGB_TO_GRAY_SUPPORTED 4953| 9.77k| if ((png_ptr->transformations & PNG_RGB_TO_GRAY) != 0) ------------------ | | 681| 9.77k|#define PNG_RGB_TO_GRAY 0x600000U /* two bits, RGB_TO_GRAY_ERR|WARN */ ------------------ | Branch (4953:8): [True: 0, False: 9.77k] ------------------ 4954| 0| { 4955| 0| int rgb_error = 4956| 0| png_do_rgb_to_gray(png_ptr, row_info, 4957| 0| png_ptr->row_buf + 1); 4958| | 4959| 0| if (rgb_error != 0) ------------------ | Branch (4959:11): [True: 0, False: 0] ------------------ 4960| 0| { 4961| 0| png_ptr->rgb_to_gray_status=1; 4962| 0| if ((png_ptr->transformations & PNG_RGB_TO_GRAY) == ------------------ | | 681| 0|#define PNG_RGB_TO_GRAY 0x600000U /* two bits, RGB_TO_GRAY_ERR|WARN */ ------------------ | Branch (4962:14): [True: 0, False: 0] ------------------ 4963| 0| PNG_RGB_TO_GRAY_WARN) ------------------ | | 680| 0|#define PNG_RGB_TO_GRAY_WARN 0x400000U ------------------ 4964| 0| png_warning(png_ptr, "png_do_rgb_to_gray found nongray pixel"); ------------------ | | 450| 0|#define png_warning OSS_FUZZ_png_warning ------------------ 4965| | 4966| 0| if ((png_ptr->transformations & PNG_RGB_TO_GRAY) == ------------------ | | 681| 0|#define PNG_RGB_TO_GRAY 0x600000U /* two bits, RGB_TO_GRAY_ERR|WARN */ ------------------ | Branch (4966:14): [True: 0, False: 0] ------------------ 4967| 0| PNG_RGB_TO_GRAY_ERR) ------------------ | | 679| 0|#define PNG_RGB_TO_GRAY_ERR 0x200000U ------------------ 4968| 0| png_error(png_ptr, "png_do_rgb_to_gray found nongray pixel"); ------------------ | | 252| 0|#define png_error OSS_FUZZ_png_error ------------------ 4969| 0| } 4970| 0| } 4971| 9.77k|#endif 4972| | 4973| |/* From Andreas Dilger e-mail to png-implement, 26 March 1998: 4974| | * 4975| | * In most cases, the "simple transparency" should be done prior to doing 4976| | * gray-to-RGB, or you will have to test 3x as many bytes to check if a 4977| | * pixel is transparent. You would also need to make sure that the 4978| | * transparency information is upgraded to RGB. 4979| | * 4980| | * To summarize, the current flow is: 4981| | * - Gray + simple transparency -> compare 1 or 2 gray bytes and composite 4982| | * with background "in place" if transparent, 4983| | * convert to RGB if necessary 4984| | * - Gray + alpha -> composite with gray background and remove alpha bytes, 4985| | * convert to RGB if necessary 4986| | * 4987| | * To support RGB backgrounds for gray images we need: 4988| | * - Gray + simple transparency -> convert to RGB + simple transparency, 4989| | * compare 3 or 6 bytes and composite with 4990| | * background "in place" if transparent 4991| | * (3x compare/pixel compared to doing 4992| | * composite with gray bkgrnd) 4993| | * - Gray + alpha -> convert to RGB + alpha, composite with background and 4994| | * remove alpha bytes (3x float 4995| | * operations/pixel compared with composite 4996| | * on gray background) 4997| | * 4998| | * Greg's change will do this. The reason it wasn't done before is for 4999| | * performance, as this increases the per-pixel operations. If we would check 5000| | * in advance if the background was gray or RGB, and position the gray-to-RGB 5001| | * transform appropriately, then it would save a lot of work/time. 5002| | */ 5003| | 5004| 9.77k|#ifdef PNG_READ_GRAY_TO_RGB_SUPPORTED 5005| | /* If gray -> RGB, do so now only if background is non-gray; else do later 5006| | * for performance reasons 5007| | */ 5008| 9.77k| if ((png_ptr->transformations & PNG_GRAY_TO_RGB) != 0 && ------------------ | | 672| 9.77k|#define PNG_GRAY_TO_RGB 0x4000U ------------------ | Branch (5008:8): [True: 0, False: 9.77k] ------------------ 5009| 0| (png_ptr->mode & PNG_BACKGROUND_IS_GRAY) == 0) ------------------ | | 651| 0|#define PNG_BACKGROUND_IS_GRAY 0x800U ------------------ | Branch (5009:8): [True: 0, False: 0] ------------------ 5010| 0| png_do_gray_to_rgb(row_info, png_ptr->row_buf + 1); 5011| 9.77k|#endif 5012| | 5013| 9.77k|#if defined(PNG_READ_BACKGROUND_SUPPORTED) ||\ 5014| 9.77k| defined(PNG_READ_ALPHA_MODE_SUPPORTED) 5015| 9.77k| if ((png_ptr->transformations & PNG_COMPOSE) != 0) ------------------ | | 665| 9.77k|#define PNG_COMPOSE 0x0080U /* Was PNG_BACKGROUND */ ------------------ | Branch (5015:8): [True: 5.69k, False: 4.07k] ------------------ 5016| 5.69k| png_do_compose(row_info, png_ptr->row_buf + 1, png_ptr); 5017| 9.77k|#endif 5018| | 5019| 9.77k|#ifdef PNG_READ_GAMMA_SUPPORTED 5020| 9.77k| if ((png_ptr->transformations & PNG_GAMMA) != 0 && ------------------ | | 671| 9.77k|#define PNG_GAMMA 0x2000U ------------------ | Branch (5020:8): [True: 3.04k, False: 6.73k] ------------------ 5021| 3.04k|#ifdef PNG_READ_RGB_TO_GRAY_SUPPORTED 5022| | /* Because RGB_TO_GRAY does the gamma transform. */ 5023| 3.04k| (png_ptr->transformations & PNG_RGB_TO_GRAY) == 0 && ------------------ | | 681| 3.04k|#define PNG_RGB_TO_GRAY 0x600000U /* two bits, RGB_TO_GRAY_ERR|WARN */ ------------------ | Branch (5023:7): [True: 3.04k, False: 0] ------------------ 5024| 3.04k|#endif 5025| 3.04k|#if defined(PNG_READ_BACKGROUND_SUPPORTED) ||\ 5026| 3.04k| defined(PNG_READ_ALPHA_MODE_SUPPORTED) 5027| | /* Because PNG_COMPOSE does the gamma transform if there is something to 5028| | * do (if there is an alpha channel or transparency.) 5029| | */ 5030| 3.04k| !((png_ptr->transformations & PNG_COMPOSE) != 0 && ------------------ | | 665| 3.04k|#define PNG_COMPOSE 0x0080U /* Was PNG_BACKGROUND */ ------------------ | Branch (5030:10): [True: 2.35k, False: 685] ------------------ 5031| 2.35k| ((png_ptr->num_trans != 0) || ------------------ | Branch (5031:9): [True: 1.40k, False: 950] ------------------ 5032| 950| (png_ptr->color_type & PNG_COLOR_MASK_ALPHA) != 0)) && ------------------ | | 663| 950|#define PNG_COLOR_MASK_ALPHA 4 ------------------ | Branch (5032:8): [True: 950, False: 0] ------------------ 5033| 685|#endif 5034| | /* Because png_init_read_transformations transforms the palette, unless 5035| | * RGB_TO_GRAY will do the transform. 5036| | */ 5037| 685| (png_ptr->color_type != PNG_COLOR_TYPE_PALETTE)) ------------------ | | 667| 685|#define PNG_COLOR_TYPE_PALETTE (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_PALETTE) | | ------------------ | | | | 662| 685|#define PNG_COLOR_MASK_COLOR 2 | | ------------------ | | #define PNG_COLOR_TYPE_PALETTE (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_PALETTE) | | ------------------ | | | | 661| 685|#define PNG_COLOR_MASK_PALETTE 1 | | ------------------ ------------------ | Branch (5037:8): [True: 685, False: 0] ------------------ 5038| 685| png_do_gamma(row_info, png_ptr->row_buf + 1, png_ptr); 5039| 9.77k|#endif 5040| | 5041| 9.77k|#ifdef PNG_READ_STRIP_ALPHA_SUPPORTED 5042| 9.77k| if ((png_ptr->transformations & PNG_STRIP_ALPHA) != 0 && ------------------ | | 676| 9.77k|#define PNG_STRIP_ALPHA 0x40000U ------------------ | Branch (5042:8): [True: 0, False: 9.77k] ------------------ 5043| 0| (png_ptr->transformations & PNG_COMPOSE) != 0 && ------------------ | | 665| 0|#define PNG_COMPOSE 0x0080U /* Was PNG_BACKGROUND */ ------------------ | Branch (5043:8): [True: 0, False: 0] ------------------ 5044| 0| (row_info->color_type == PNG_COLOR_TYPE_RGB_ALPHA || ------------------ | | 669| 0|#define PNG_COLOR_TYPE_RGB_ALPHA (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_ALPHA) | | ------------------ | | | | 662| 0|#define PNG_COLOR_MASK_COLOR 2 | | ------------------ | | #define PNG_COLOR_TYPE_RGB_ALPHA (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_ALPHA) | | ------------------ | | | | 663| 0|#define PNG_COLOR_MASK_ALPHA 4 | | ------------------ ------------------ | Branch (5044:9): [True: 0, False: 0] ------------------ 5045| 0| row_info->color_type == PNG_COLOR_TYPE_GRAY_ALPHA)) ------------------ | | 670| 0|#define PNG_COLOR_TYPE_GRAY_ALPHA (PNG_COLOR_MASK_ALPHA) | | ------------------ | | | | 663| 0|#define PNG_COLOR_MASK_ALPHA 4 | | ------------------ ------------------ | Branch (5045:8): [True: 0, False: 0] ------------------ 5046| 0| png_do_strip_channel(row_info, png_ptr->row_buf + 1, ------------------ | | 44| 0|#define png_do_strip_channel OSS_FUZZ_png_do_strip_channel ------------------ 5047| 0| 0 /* at_start == false, because SWAP_ALPHA happens later */); 5048| 9.77k|#endif 5049| | 5050| 9.77k|#ifdef PNG_READ_ALPHA_MODE_SUPPORTED 5051| 9.77k| if ((png_ptr->transformations & PNG_ENCODE_ALPHA) != 0 && ------------------ | | 682| 9.77k|#define PNG_ENCODE_ALPHA 0x800000U /* Added to libpng-1.5.4 */ ------------------ | Branch (5051:8): [True: 0, False: 9.77k] ------------------ 5052| 0| (row_info->color_type & PNG_COLOR_MASK_ALPHA) != 0) ------------------ | | 663| 0|#define PNG_COLOR_MASK_ALPHA 4 ------------------ | Branch (5052:8): [True: 0, False: 0] ------------------ 5053| 0| png_do_encode_alpha(row_info, png_ptr->row_buf + 1, png_ptr); 5054| 9.77k|#endif 5055| | 5056| 9.77k|#ifdef PNG_READ_SCALE_16_TO_8_SUPPORTED 5057| 9.77k| if ((png_ptr->transformations & PNG_SCALE_16_TO_8) != 0) ------------------ | | 685| 9.77k|#define PNG_SCALE_16_TO_8 0x4000000U /* Added to libpng-1.5.4 */ ------------------ | Branch (5057:8): [True: 3.31k, False: 6.46k] ------------------ 5058| 3.31k| png_do_scale_16_to_8(row_info, png_ptr->row_buf + 1); 5059| 9.77k|#endif 5060| | 5061| 9.77k|#ifdef PNG_READ_STRIP_16_TO_8_SUPPORTED 5062| | /* There is no harm in doing both of these because only one has any effect, 5063| | * by putting the 'scale' option first if the app asks for scale (either by 5064| | * calling the API or in a TRANSFORM flag) this is what happens. 5065| | */ 5066| 9.77k| if ((png_ptr->transformations & PNG_16_TO_8) != 0) ------------------ | | 668| 9.77k|#define PNG_16_TO_8 0x0400U /* Becomes 'chop' in 1.5.4 */ ------------------ | Branch (5066:8): [True: 0, False: 9.77k] ------------------ 5067| 0| png_do_chop(row_info, png_ptr->row_buf + 1); 5068| 9.77k|#endif 5069| | 5070| 9.77k|#ifdef PNG_READ_QUANTIZE_SUPPORTED 5071| 9.77k| if ((png_ptr->transformations & PNG_QUANTIZE) != 0) ------------------ | | 664| 9.77k|#define PNG_QUANTIZE 0x0040U ------------------ | Branch (5071:8): [True: 3.79k, False: 5.98k] ------------------ 5072| 3.79k| png_do_quantize(row_info, png_ptr->row_buf + 1, 5073| 3.79k| png_ptr->palette_lookup, png_ptr->quantize_index); 5074| 9.77k|#endif /* READ_QUANTIZE */ 5075| | 5076| 9.77k|#ifdef PNG_READ_EXPAND_16_SUPPORTED 5077| | /* Do the expansion now, after all the arithmetic has been done. Notice 5078| | * that previous transformations can handle the PNG_EXPAND_16 flag if this 5079| | * is efficient (particularly true in the case of gamma correction, where 5080| | * better accuracy results faster!) 5081| | */ 5082| 9.77k| if ((png_ptr->transformations & PNG_EXPAND_16) != 0) ------------------ | | 667| 9.77k|#define PNG_EXPAND_16 0x0200U /* Added to libpng 1.5.2 */ ------------------ | Branch (5082:8): [True: 0, False: 9.77k] ------------------ 5083| 0| png_do_expand_16(row_info, png_ptr->row_buf + 1); 5084| 9.77k|#endif 5085| | 5086| 9.77k|#ifdef PNG_READ_GRAY_TO_RGB_SUPPORTED 5087| | /* NOTE: moved here in 1.5.4 (from much later in this list.) */ 5088| 9.77k| if ((png_ptr->transformations & PNG_GRAY_TO_RGB) != 0 && ------------------ | | 672| 9.77k|#define PNG_GRAY_TO_RGB 0x4000U ------------------ | Branch (5088:8): [True: 0, False: 9.77k] ------------------ 5089| 0| (png_ptr->mode & PNG_BACKGROUND_IS_GRAY) != 0) ------------------ | | 651| 0|#define PNG_BACKGROUND_IS_GRAY 0x800U ------------------ | Branch (5089:8): [True: 0, False: 0] ------------------ 5090| 0| png_do_gray_to_rgb(row_info, png_ptr->row_buf + 1); 5091| 9.77k|#endif 5092| | 5093| 9.77k|#ifdef PNG_READ_INVERT_SUPPORTED 5094| 9.77k| if ((png_ptr->transformations & PNG_INVERT_MONO) != 0) ------------------ | | 663| 9.77k|#define PNG_INVERT_MONO 0x0020U ------------------ | Branch (5094:8): [True: 0, False: 9.77k] ------------------ 5095| 0| png_do_invert(row_info, png_ptr->row_buf + 1); ------------------ | | 47| 0|#define png_do_invert OSS_FUZZ_png_do_invert ------------------ 5096| 9.77k|#endif 5097| | 5098| 9.77k|#ifdef PNG_READ_INVERT_ALPHA_SUPPORTED 5099| 9.77k| if ((png_ptr->transformations & PNG_INVERT_ALPHA) != 0) ------------------ | | 677| 9.77k|#define PNG_INVERT_ALPHA 0x80000U ------------------ | Branch (5099:8): [True: 2.44k, False: 7.32k] ------------------ 5100| 2.44k| png_do_read_invert_alpha(row_info, png_ptr->row_buf + 1); 5101| 9.77k|#endif 5102| | 5103| 9.77k|#ifdef PNG_READ_SHIFT_SUPPORTED 5104| 9.77k| if ((png_ptr->transformations & PNG_SHIFT) != 0) ------------------ | | 661| 9.77k|#define PNG_SHIFT 0x0008U ------------------ | Branch (5104:8): [True: 0, False: 9.77k] ------------------ 5105| 0| png_do_unshift(row_info, png_ptr->row_buf + 1, 5106| 0| &(png_ptr->shift)); 5107| 9.77k|#endif 5108| | 5109| 9.77k|#ifdef PNG_READ_PACK_SUPPORTED 5110| 9.77k| if ((png_ptr->transformations & PNG_PACK) != 0) ------------------ | | 660| 9.77k|#define PNG_PACK 0x0004U ------------------ | Branch (5110:8): [True: 3.11k, False: 6.66k] ------------------ 5111| 3.11k| png_do_unpack(row_info, png_ptr->row_buf + 1); 5112| 9.77k|#endif 5113| | 5114| 9.77k|#ifdef PNG_READ_CHECK_FOR_INVALID_INDEX_SUPPORTED 5115| | /* Added at libpng-1.5.10 */ 5116| 9.77k| if (row_info->color_type == PNG_COLOR_TYPE_PALETTE && ------------------ | | 667| 19.5k|#define PNG_COLOR_TYPE_PALETTE (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_PALETTE) | | ------------------ | | | | 662| 9.77k|#define PNG_COLOR_MASK_COLOR 2 | | ------------------ | | #define PNG_COLOR_TYPE_PALETTE (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_PALETTE) | | ------------------ | | | | 661| 9.77k|#define PNG_COLOR_MASK_PALETTE 1 | | ------------------ ------------------ | Branch (5116:8): [True: 432, False: 9.34k] ------------------ 5117| 432| png_ptr->num_palette_max >= 0) ------------------ | Branch (5117:8): [True: 432, False: 0] ------------------ 5118| 432| png_do_check_palette_indexes(png_ptr, row_info); ------------------ | | 73| 432|#define png_do_check_palette_indexes OSS_FUZZ_png_do_check_palette_indexes ------------------ 5119| 9.77k|#endif 5120| | 5121| 9.77k|#ifdef PNG_READ_BGR_SUPPORTED 5122| 9.77k| if ((png_ptr->transformations & PNG_BGR) != 0) ------------------ | | 658| 9.77k|#define PNG_BGR 0x0001U ------------------ | Branch (5122:8): [True: 0, False: 9.77k] ------------------ 5123| 0| png_do_bgr(row_info, png_ptr->row_buf + 1); ------------------ | | 48| 0|#define png_do_bgr OSS_FUZZ_png_do_bgr ------------------ 5124| 9.77k|#endif 5125| | 5126| 9.77k|#ifdef PNG_READ_PACKSWAP_SUPPORTED 5127| 9.77k| if ((png_ptr->transformations & PNG_PACKSWAP) != 0) ------------------ | | 674| 9.77k|#define PNG_PACKSWAP 0x10000U ------------------ | Branch (5127:8): [True: 0, False: 9.77k] ------------------ 5128| 0| png_do_packswap(row_info, png_ptr->row_buf + 1); ------------------ | | 46| 0|#define png_do_packswap OSS_FUZZ_png_do_packswap ------------------ 5129| 9.77k|#endif 5130| | 5131| 9.77k|#ifdef PNG_READ_FILLER_SUPPORTED 5132| 9.77k| if ((png_ptr->transformations & PNG_FILLER) != 0) ------------------ | | 673| 9.77k|#define PNG_FILLER 0x8000U ------------------ | Branch (5132:8): [True: 0, False: 9.77k] ------------------ 5133| 0| png_do_read_filler(row_info, png_ptr->row_buf + 1, 5134| 0| (png_uint_32)png_ptr->filler, png_ptr->flags); 5135| 9.77k|#endif 5136| | 5137| 9.77k|#ifdef PNG_READ_SWAP_ALPHA_SUPPORTED 5138| 9.77k| if ((png_ptr->transformations & PNG_SWAP_ALPHA) != 0) ------------------ | | 675| 9.77k|#define PNG_SWAP_ALPHA 0x20000U ------------------ | Branch (5138:8): [True: 2.44k, False: 7.32k] ------------------ 5139| 2.44k| png_do_read_swap_alpha(row_info, png_ptr->row_buf + 1); 5140| 9.77k|#endif 5141| | 5142| 9.77k|#ifdef PNG_READ_16BIT_SUPPORTED 5143| 9.77k|#ifdef PNG_READ_SWAP_SUPPORTED 5144| 9.77k| if ((png_ptr->transformations & PNG_SWAP_BYTES) != 0) ------------------ | | 662| 9.77k|#define PNG_SWAP_BYTES 0x0010U ------------------ | Branch (5144:8): [True: 0, False: 9.77k] ------------------ 5145| 0| png_do_swap(row_info, png_ptr->row_buf + 1); ------------------ | | 45| 0|#define png_do_swap OSS_FUZZ_png_do_swap ------------------ 5146| 9.77k|#endif 5147| 9.77k|#endif 5148| | 5149| 9.77k|#ifdef PNG_READ_USER_TRANSFORM_SUPPORTED 5150| 9.77k| if ((png_ptr->transformations & PNG_USER_TRANSFORM) != 0) ------------------ | | 678| 9.77k|#define PNG_USER_TRANSFORM 0x100000U ------------------ | Branch (5150:8): [True: 0, False: 9.77k] ------------------ 5151| 0| { 5152| 0| if (png_ptr->read_user_transform_fn != NULL) ------------------ | Branch (5152:11): [True: 0, False: 0] ------------------ 5153| 0| (*(png_ptr->read_user_transform_fn)) /* User read transform function */ 5154| 0| (png_ptr, /* png_ptr */ 5155| 0| row_info, /* row_info: */ 5156| | /* png_uint_32 width; width of row */ 5157| | /* size_t rowbytes; number of bytes in row */ 5158| | /* png_byte color_type; color type of pixels */ 5159| | /* png_byte bit_depth; bit depth of samples */ 5160| | /* png_byte channels; number of channels (1-4) */ 5161| | /* png_byte pixel_depth; bits per pixel (depth*channels) */ 5162| 0| png_ptr->row_buf + 1); /* start of pixel data for row */ 5163| 0|#ifdef PNG_USER_TRANSFORM_PTR_SUPPORTED 5164| 0| if (png_ptr->user_transform_depth != 0) ------------------ | Branch (5164:11): [True: 0, False: 0] ------------------ 5165| 0| row_info->bit_depth = png_ptr->user_transform_depth; 5166| | 5167| 0| if (png_ptr->user_transform_channels != 0) ------------------ | Branch (5167:11): [True: 0, False: 0] ------------------ 5168| 0| row_info->channels = png_ptr->user_transform_channels; 5169| 0|#endif 5170| 0| row_info->pixel_depth = (png_byte)(row_info->bit_depth * 5171| 0| row_info->channels); 5172| | 5173| 0| row_info->rowbytes = PNG_ROWBYTES(row_info->pixel_depth, row_info->width); ------------------ | | 755| 0| ((pixel_bits) >= 8 ? \ | | ------------------ | | | Branch (755:6): [True: 0, False: 0] | | ------------------ | | 756| 0| ((size_t)(width) * (((size_t)(pixel_bits)) >> 3)) : \ | | 757| 0| (( ((size_t)(width) * ((size_t)(pixel_bits))) + 7) >> 3) ) ------------------ 5174| 0| } 5175| 9.77k|#endif 5176| 9.77k|} pngrtran.c:png_rtran_ok: 116| 2.24k|{ 117| 2.24k| if (png_ptr != NULL) ------------------ | Branch (117:8): [True: 2.24k, False: 0] ------------------ 118| 2.24k| { 119| 2.24k| if ((png_ptr->flags & PNG_FLAG_ROW_INIT) != 0) ------------------ | | 701| 2.24k|#define PNG_FLAG_ROW_INIT 0x0040U ------------------ | Branch (119:11): [True: 0, False: 2.24k] ------------------ 120| 0| png_app_error(png_ptr, ------------------ | | 82| 0|#define png_app_error OSS_FUZZ_png_app_error ------------------ 121| 0| "invalid after png_start_read_image or png_read_update_info"); 122| | 123| 2.24k| else if (need_IHDR && (png_ptr->mode & PNG_HAVE_IHDR) == 0) ------------------ | | 642| 0|#define PNG_HAVE_IHDR 0x01 ------------------ | Branch (123:16): [True: 0, False: 2.24k] | Branch (123:29): [True: 0, False: 0] ------------------ 124| 0| png_app_error(png_ptr, "invalid before the PNG header has been read"); ------------------ | | 82| 0|#define png_app_error OSS_FUZZ_png_app_error ------------------ 125| | 126| 2.24k| else 127| 2.24k| { 128| | /* Turn on failure to initialize correctly for all transforms. */ 129| 2.24k| png_ptr->flags |= PNG_FLAG_DETECT_UNINITIALIZED; ------------------ | | 709| 2.24k|#define PNG_FLAG_DETECT_UNINITIALIZED 0x4000U /* Added to libpng-1.5.4 */ ------------------ 130| | 131| 2.24k| return 1; /* Ok */ 132| 2.24k| } 133| 2.24k| } 134| | 135| 0| return 0; /* no png_error possible! */ 136| 2.24k|} pngrtran.c:translate_gamma_flags: 280| 1.25k|{ 281| | /* Check for flag values. The main reason for having the old Mac value as a 282| | * flag is that it is pretty near impossible to work out what the correct 283| | * value is from Apple documentation - a working Mac system is needed to 284| | * discover the value! 285| | */ 286| 1.25k| if (output_gamma == PNG_DEFAULT_sRGB || ------------------ | | 1189| 2.50k|#define PNG_DEFAULT_sRGB -1 /* sRGB gamma and color space */ ------------------ | Branch (286:8): [True: 0, False: 1.25k] ------------------ 287| 1.25k| output_gamma == PNG_FP_1 / PNG_DEFAULT_sRGB) ------------------ | | 654| 1.25k|#define PNG_FP_1 100000 ------------------ output_gamma == PNG_FP_1 / PNG_DEFAULT_sRGB) ------------------ | | 1189| 1.25k|#define PNG_DEFAULT_sRGB -1 /* sRGB gamma and color space */ ------------------ | Branch (287:7): [True: 0, False: 1.25k] ------------------ 288| 0| { 289| 0| if (is_screen != 0) ------------------ | Branch (289:11): [True: 0, False: 0] ------------------ 290| 0| output_gamma = PNG_GAMMA_sRGB; ------------------ | | 1191| 0|#define PNG_GAMMA_sRGB 220000 /* Television standards--matches sRGB gamma */ ------------------ 291| 0| else 292| 0| output_gamma = PNG_GAMMA_sRGB_INVERSE; ------------------ | | 1000| 0|#define PNG_GAMMA_sRGB_INVERSE 45455 ------------------ 293| 0| } 294| | 295| 1.25k| else if (output_gamma == PNG_GAMMA_MAC_18 || ------------------ | | 1190| 2.50k|#define PNG_GAMMA_MAC_18 -2 /* Old Mac '1.8' gamma and color space */ ------------------ | Branch (295:13): [True: 0, False: 1.25k] ------------------ 296| 1.25k| output_gamma == PNG_FP_1 / PNG_GAMMA_MAC_18) ------------------ | | 654| 1.25k|#define PNG_FP_1 100000 ------------------ output_gamma == PNG_FP_1 / PNG_GAMMA_MAC_18) ------------------ | | 1190| 1.25k|#define PNG_GAMMA_MAC_18 -2 /* Old Mac '1.8' gamma and color space */ ------------------ | Branch (296:7): [True: 0, False: 1.25k] ------------------ 297| 0| { 298| 0| if (is_screen != 0) ------------------ | Branch (298:11): [True: 0, False: 0] ------------------ 299| 0| output_gamma = PNG_GAMMA_MAC_OLD; ------------------ | | 998| 0|#define PNG_GAMMA_MAC_OLD 151724 /* Assume '1.8' is really 2.2/1.45! */ ------------------ 300| 0| else 301| 0| output_gamma = PNG_GAMMA_MAC_INVERSE; ------------------ | | 999| 0|#define PNG_GAMMA_MAC_INVERSE 65909 ------------------ 302| 0| } 303| | 304| 1.25k| return output_gamma; 305| 1.25k|} pngrtran.c:unsupported_gamma: 333| 1.25k|{ 334| | /* Validate a gamma value to ensure it is in a reasonable range. The value 335| | * is expected to be 1 or greater, but this range test allows for some 336| | * viewing correction values. The intent is to weed out the API users 337| | * who might use the inverse of the gamma value accidentally! 338| | * 339| | * 1.6.47: apply the test in png_set_gamma as well but only warn and return 340| | * false if it fires. 341| | * 342| | * TODO: 1.8: make this an app_error in png_set_gamma as well. 343| | */ 344| 1.25k| if (gamma < PNG_LIB_GAMMA_MIN || gamma > PNG_LIB_GAMMA_MAX) ------------------ | | 1012| 2.50k|#define PNG_LIB_GAMMA_MIN 1000 ------------------ if (gamma < PNG_LIB_GAMMA_MIN || gamma > PNG_LIB_GAMMA_MAX) ------------------ | | 1013| 1.25k|#define PNG_LIB_GAMMA_MAX 10000000 ------------------ | Branch (344:8): [True: 0, False: 1.25k] | Branch (344:37): [True: 0, False: 1.25k] ------------------ 345| 0| { 346| 0|# define msg "gamma out of supported range" 347| 0| if (warn) ------------------ | Branch (347:11): [True: 0, False: 0] ------------------ 348| 0| png_app_warning(png_ptr, msg); ------------------ | | 81| 0|#define png_app_warning OSS_FUZZ_png_app_warning ------------------ png_app_warning(png_ptr, msg); ------------------ | | 346| 0|# define msg "gamma out of supported range" ------------------ 349| 0| else 350| 0| png_app_error(png_ptr, msg); ------------------ | | 82| 0|#define png_app_error OSS_FUZZ_png_app_error ------------------ png_app_error(png_ptr, msg); ------------------ | | 346| 0|# define msg "gamma out of supported range" ------------------ 351| 0| return 1; 352| 0|# undef msg 353| 0| } 354| | 355| 1.25k| return 0; 356| 1.25k|} pngrtran.c:convert_gamma_value: 310| 1.25k|{ 311| | /* The following silently ignores cases where fixed point (times 100,000) 312| | * gamma values are passed to the floating point API. This is safe and it 313| | * means the fixed point constants work just fine with the floating point 314| | * API. The alternative would just lead to undetected errors and spurious 315| | * bug reports. Negative values fail inside the _fixed API unless they 316| | * correspond to the flag values. 317| | */ 318| 1.25k| if (output_gamma > 0 && output_gamma < 128) ------------------ | Branch (318:8): [True: 1.25k, False: 0] | Branch (318:28): [True: 0, False: 1.25k] ------------------ 319| 0| output_gamma *= PNG_FP_1; ------------------ | | 654| 0|#define PNG_FP_1 100000 ------------------ 320| | 321| | /* This preserves -1 and -2 exactly: */ 322| 1.25k| output_gamma = floor(output_gamma + .5); 323| | 324| 1.25k| if (output_gamma > PNG_FP_MAX || output_gamma < PNG_FP_MIN) ------------------ | | 656| 2.50k|#define PNG_FP_MAX ((png_fixed_point)0x7fffffffL) ------------------ if (output_gamma > PNG_FP_MAX || output_gamma < PNG_FP_MIN) ------------------ | | 657| 1.25k|#define PNG_FP_MIN (-PNG_FP_MAX) | | ------------------ | | | | 656| 1.25k|#define PNG_FP_MAX ((png_fixed_point)0x7fffffffL) | | ------------------ ------------------ | Branch (324:8): [True: 0, False: 1.25k] | Branch (324:37): [True: 0, False: 1.25k] ------------------ 325| 0| png_fixed_error(png_ptr, "gamma value"); ------------------ | | 74| 0|#define png_fixed_error OSS_FUZZ_png_fixed_error ------------------ 326| | 327| 1.25k| return (png_fixed_point)output_gamma; 328| 1.25k|} pngrtran.c:png_init_gamma_values: 1388| 1.25k|{ 1389| | /* The following temporary indicates if overall gamma correction is 1390| | * required. 1391| | */ 1392| 1.25k| int gamma_correction = 0; 1393| 1.25k| png_fixed_point file_gamma, screen_gamma; 1394| | 1395| | /* Resolve the file_gamma. See above: if png_ptr::screen_gamma is set 1396| | * file_gamma will always be set here: 1397| | */ 1398| 1.25k| file_gamma = png_resolve_file_gamma(png_ptr); ------------------ | | 92| 1.25k|#define png_resolve_file_gamma OSS_FUZZ_png_resolve_file_gamma ------------------ 1399| 1.25k| screen_gamma = png_ptr->screen_gamma; 1400| | 1401| 1.25k| if (file_gamma > 0) /* file has been set */ ------------------ | Branch (1401:8): [True: 1.25k, False: 0] ------------------ 1402| 1.25k| { 1403| 1.25k| if (screen_gamma > 0) /* screen set too */ ------------------ | Branch (1403:11): [True: 1.25k, False: 0] ------------------ 1404| 1.25k| gamma_correction = png_gamma_threshold(file_gamma, screen_gamma); 1405| | 1406| 0| else 1407| | /* Assume the output matches the input; a long time default behavior 1408| | * of libpng, although the standard has nothing to say about this. 1409| | */ 1410| 0| screen_gamma = png_reciprocal(file_gamma); ------------------ | | 89| 0|#define png_reciprocal OSS_FUZZ_png_reciprocal ------------------ 1411| 1.25k| } 1412| | 1413| 0| else /* both unset, prevent corrections: */ 1414| 0| file_gamma = screen_gamma = PNG_FP_1; ------------------ | | 654| 0|#define PNG_FP_1 100000 ------------------ 1415| | 1416| 1.25k| png_ptr->file_gamma = file_gamma; 1417| 1.25k| png_ptr->screen_gamma = screen_gamma; 1418| 1.25k| return gamma_correction; 1419| | 1420| 1.25k|} pngrtran.c:png_gamma_threshold: 1152| 1.25k|{ 1153| | /* PNG_GAMMA_THRESHOLD is the threshold for performing gamma 1154| | * correction as a difference of the overall transform from 1.0 1155| | * 1156| | * We want to compare the threshold with s*f - 1, if we get 1157| | * overflow here it is because of wacky gamma values so we 1158| | * turn on processing anyway. 1159| | */ 1160| 1.25k| png_fixed_point gtest; 1161| 1.25k| return !png_muldiv(>est, screen_gamma, file_gamma, PNG_FP_1) || ------------------ | | 88| 1.25k|#define png_muldiv OSS_FUZZ_png_muldiv ------------------ return !png_muldiv(>est, screen_gamma, file_gamma, PNG_FP_1) || ------------------ | | 654| 1.25k|#define PNG_FP_1 100000 ------------------ | Branch (1161:11): [True: 0, False: 1.25k] ------------------ 1162| 1.25k| png_gamma_significant(gtest); ------------------ | | 91| 1.25k|#define png_gamma_significant OSS_FUZZ_png_gamma_significant ------------------ | Branch (1162:8): [True: 456, False: 794] ------------------ 1163| 1.25k|} pngrtran.c:png_init_palette_transformations: 1177| 74|{ 1178| | /* Called to handle the (input) palette case. In png_do_read_transformations 1179| | * the first step is to expand the palette if requested, so this code must 1180| | * take care to only make changes that are invariant with respect to the 1181| | * palette expansion, or only do them if there is no expansion. 1182| | * 1183| | * STRIP_ALPHA has already been handled in the caller (by setting num_trans 1184| | * to 0.) 1185| | */ 1186| 74| int input_has_alpha = 0; 1187| 74| int input_has_transparency = 0; 1188| | 1189| 74| if (png_ptr->num_trans > 0) ------------------ | Branch (1189:8): [True: 31, False: 43] ------------------ 1190| 31| { 1191| 31| int i; 1192| | 1193| | /* Ignore if all the entries are opaque (unlikely!) */ 1194| 81| for (i=0; inum_trans; ++i) ------------------ | Branch (1194:17): [True: 70, False: 11] ------------------ 1195| 70| { 1196| 70| if (png_ptr->trans_alpha[i] == 255) ------------------ | Branch (1196:14): [True: 19, False: 51] ------------------ 1197| 19| continue; 1198| 51| else if (png_ptr->trans_alpha[i] == 0) ------------------ | Branch (1198:19): [True: 31, False: 20] ------------------ 1199| 31| input_has_transparency = 1; 1200| 20| else 1201| 20| { 1202| 20| input_has_transparency = 1; 1203| 20| input_has_alpha = 1; 1204| 20| break; 1205| 20| } 1206| 70| } 1207| 31| } 1208| | 1209| | /* If no alpha we can optimize. */ 1210| 74| if (input_has_alpha == 0) ------------------ | Branch (1210:8): [True: 54, False: 20] ------------------ 1211| 54| { 1212| | /* Any alpha means background and associative alpha processing is 1213| | * required, however if the alpha is 0 or 1 throughout OPTIMIZE_ALPHA 1214| | * and ENCODE_ALPHA are irrelevant. 1215| | */ 1216| 54| png_ptr->transformations &= ~PNG_ENCODE_ALPHA; ------------------ | | 682| 54|#define PNG_ENCODE_ALPHA 0x800000U /* Added to libpng-1.5.4 */ ------------------ 1217| 54| png_ptr->flags &= ~PNG_FLAG_OPTIMIZE_ALPHA; ------------------ | | 708| 54|#define PNG_FLAG_OPTIMIZE_ALPHA 0x2000U /* Added to libpng-1.5.4 */ ------------------ 1218| | 1219| 54| if (input_has_transparency == 0) ------------------ | Branch (1219:11): [True: 45, False: 9] ------------------ 1220| 45| png_ptr->transformations &= ~(PNG_COMPOSE | PNG_BACKGROUND_EXPAND); ------------------ | | 665| 45|#define PNG_COMPOSE 0x0080U /* Was PNG_BACKGROUND */ ------------------ png_ptr->transformations &= ~(PNG_COMPOSE | PNG_BACKGROUND_EXPAND); ------------------ | | 666| 45|#define PNG_BACKGROUND_EXPAND 0x0100U ------------------ 1221| 54| } 1222| | 1223| 74|#if defined(PNG_READ_EXPAND_SUPPORTED) && defined(PNG_READ_BACKGROUND_SUPPORTED) 1224| | /* png_set_background handling - deals with the complexity of whether the 1225| | * background color is in the file format or the screen format in the case 1226| | * where an 'expand' will happen. 1227| | */ 1228| | 1229| | /* The following code cannot be entered in the alpha pre-multiplication case 1230| | * because PNG_BACKGROUND_EXPAND is cancelled below. 1231| | */ 1232| 74| if ((png_ptr->transformations & PNG_BACKGROUND_EXPAND) != 0 && ------------------ | | 666| 74|#define PNG_BACKGROUND_EXPAND 0x0100U ------------------ | Branch (1232:8): [True: 0, False: 74] ------------------ 1233| 0| (png_ptr->transformations & PNG_EXPAND) != 0) ------------------ | | 670| 0|#define PNG_EXPAND 0x1000U ------------------ | Branch (1233:8): [True: 0, False: 0] ------------------ 1234| 0| { 1235| 0| { 1236| 0| png_ptr->background.red = 1237| 0| png_ptr->palette[png_ptr->background.index].red; 1238| 0| png_ptr->background.green = 1239| 0| png_ptr->palette[png_ptr->background.index].green; 1240| 0| png_ptr->background.blue = 1241| 0| png_ptr->palette[png_ptr->background.index].blue; 1242| | 1243| 0|#ifdef PNG_READ_INVERT_ALPHA_SUPPORTED 1244| 0| if ((png_ptr->transformations & PNG_INVERT_ALPHA) != 0) ------------------ | | 677| 0|#define PNG_INVERT_ALPHA 0x80000U ------------------ | Branch (1244:14): [True: 0, False: 0] ------------------ 1245| 0| { 1246| 0| if ((png_ptr->transformations & PNG_EXPAND_tRNS) == 0) ------------------ | | 684| 0|#define PNG_EXPAND_tRNS 0x2000000U /* Added to libpng-1.2.9 */ ------------------ | Branch (1246:17): [True: 0, False: 0] ------------------ 1247| 0| { 1248| | /* Invert the alpha channel (in tRNS) unless the pixels are 1249| | * going to be expanded, in which case leave it for later 1250| | */ 1251| 0| int i, istop = png_ptr->num_trans; 1252| | 1253| 0| for (i = 0; i < istop; i++) ------------------ | Branch (1253:28): [True: 0, False: 0] ------------------ 1254| 0| png_ptr->trans_alpha[i] = 1255| 0| (png_byte)(255 - png_ptr->trans_alpha[i]); 1256| 0| } 1257| 0| } 1258| 0|#endif /* READ_INVERT_ALPHA */ 1259| 0| } 1260| 0| } /* background expand and (therefore) no alpha association. */ 1261| 74|#endif /* READ_EXPAND && READ_BACKGROUND */ 1262| 74|} pngrtran.c:png_init_rgb_transformations: 1266| 1.17k|{ 1267| | /* Added to libpng-1.5.4: check the color type to determine whether there 1268| | * is any alpha or transparency in the image and simply cancel the 1269| | * background and alpha mode stuff if there isn't. 1270| | */ 1271| 1.17k| int input_has_alpha = (png_ptr->color_type & PNG_COLOR_MASK_ALPHA) != 0; ------------------ | | 663| 1.17k|#define PNG_COLOR_MASK_ALPHA 4 ------------------ 1272| 1.17k| int input_has_transparency = png_ptr->num_trans > 0; 1273| | 1274| | /* If no alpha we can optimize. */ 1275| 1.17k| if (input_has_alpha == 0) ------------------ | Branch (1275:8): [True: 835, False: 341] ------------------ 1276| 835| { 1277| | /* Any alpha means background and associative alpha processing is 1278| | * required, however if the alpha is 0 or 1 throughout OPTIMIZE_ALPHA 1279| | * and ENCODE_ALPHA are irrelevant. 1280| | */ 1281| 835|# ifdef PNG_READ_ALPHA_MODE_SUPPORTED 1282| 835| png_ptr->transformations &= ~PNG_ENCODE_ALPHA; ------------------ | | 682| 835|#define PNG_ENCODE_ALPHA 0x800000U /* Added to libpng-1.5.4 */ ------------------ 1283| 835| png_ptr->flags &= ~PNG_FLAG_OPTIMIZE_ALPHA; ------------------ | | 708| 835|#define PNG_FLAG_OPTIMIZE_ALPHA 0x2000U /* Added to libpng-1.5.4 */ ------------------ 1284| 835|# endif 1285| | 1286| 835| if (input_has_transparency == 0) ------------------ | Branch (1286:11): [True: 374, False: 461] ------------------ 1287| 374| png_ptr->transformations &= ~(PNG_COMPOSE | PNG_BACKGROUND_EXPAND); ------------------ | | 665| 374|#define PNG_COMPOSE 0x0080U /* Was PNG_BACKGROUND */ ------------------ png_ptr->transformations &= ~(PNG_COMPOSE | PNG_BACKGROUND_EXPAND); ------------------ | | 666| 374|#define PNG_BACKGROUND_EXPAND 0x0100U ------------------ 1288| 835| } 1289| | 1290| 1.17k|#if defined(PNG_READ_EXPAND_SUPPORTED) && defined(PNG_READ_BACKGROUND_SUPPORTED) 1291| | /* png_set_background handling - deals with the complexity of whether the 1292| | * background color is in the file format or the screen format in the case 1293| | * where an 'expand' will happen. 1294| | */ 1295| | 1296| | /* The following code cannot be entered in the alpha pre-multiplication case 1297| | * because PNG_BACKGROUND_EXPAND is cancelled below. 1298| | */ 1299| 1.17k| if ((png_ptr->transformations & PNG_BACKGROUND_EXPAND) != 0 && ------------------ | | 666| 1.17k|#define PNG_BACKGROUND_EXPAND 0x0100U ------------------ | Branch (1299:8): [True: 0, False: 1.17k] ------------------ 1300| 0| (png_ptr->transformations & PNG_EXPAND) != 0 && ------------------ | | 670| 0|#define PNG_EXPAND 0x1000U ------------------ | Branch (1300:8): [True: 0, False: 0] ------------------ 1301| 0| (png_ptr->color_type & PNG_COLOR_MASK_COLOR) == 0) ------------------ | | 662| 0|#define PNG_COLOR_MASK_COLOR 2 ------------------ | Branch (1301:8): [True: 0, False: 0] ------------------ 1302| | /* i.e., GRAY or GRAY_ALPHA */ 1303| 0| { 1304| 0| { 1305| | /* Expand background and tRNS chunks */ 1306| 0| int gray = png_ptr->background.gray; 1307| 0| int trans_gray = png_ptr->trans_color.gray; 1308| | 1309| 0| switch (png_ptr->bit_depth) 1310| 0| { 1311| 0| case 1: ------------------ | Branch (1311:13): [True: 0, False: 0] ------------------ 1312| 0| gray *= 0xff; 1313| 0| trans_gray *= 0xff; 1314| 0| break; 1315| | 1316| 0| case 2: ------------------ | Branch (1316:13): [True: 0, False: 0] ------------------ 1317| 0| gray *= 0x55; 1318| 0| trans_gray *= 0x55; 1319| 0| break; 1320| | 1321| 0| case 4: ------------------ | Branch (1321:13): [True: 0, False: 0] ------------------ 1322| 0| gray *= 0x11; 1323| 0| trans_gray *= 0x11; 1324| 0| break; 1325| | 1326| 0| default: ------------------ | Branch (1326:13): [True: 0, False: 0] ------------------ 1327| | 1328| 0| case 8: ------------------ | Branch (1328:13): [True: 0, False: 0] ------------------ 1329| | /* FALLTHROUGH */ /* (Already 8 bits) */ 1330| | 1331| 0| case 16: ------------------ | Branch (1331:13): [True: 0, False: 0] ------------------ 1332| | /* Already a full 16 bits */ 1333| 0| break; 1334| 0| } 1335| | 1336| 0| png_ptr->background.red = png_ptr->background.green = 1337| 0| png_ptr->background.blue = (png_uint_16)gray; 1338| | 1339| 0| if ((png_ptr->transformations & PNG_EXPAND_tRNS) == 0) ------------------ | | 684| 0|#define PNG_EXPAND_tRNS 0x2000000U /* Added to libpng-1.2.9 */ ------------------ | Branch (1339:14): [True: 0, False: 0] ------------------ 1340| 0| { 1341| 0| png_ptr->trans_color.red = png_ptr->trans_color.green = 1342| 0| png_ptr->trans_color.blue = (png_uint_16)trans_gray; 1343| 0| } 1344| 0| } 1345| 0| } /* background expand and (therefore) no alpha association. */ 1346| 1.17k|#endif /* READ_EXPAND && READ_BACKGROUND */ 1347| 1.17k|} pngrtran.c:png_do_compose: 3341| 5.69k|{ 3342| 5.69k|#ifdef PNG_READ_GAMMA_SUPPORTED 3343| 5.69k| png_const_bytep gamma_table = png_ptr->gamma_table; 3344| 5.69k| png_const_bytep gamma_from_1 = png_ptr->gamma_from_1; 3345| 5.69k| png_const_bytep gamma_to_1 = png_ptr->gamma_to_1; 3346| 5.69k| png_const_uint_16pp gamma_16 = png_ptr->gamma_16_table; 3347| 5.69k| png_const_uint_16pp gamma_16_from_1 = png_ptr->gamma_16_from_1; 3348| 5.69k| png_const_uint_16pp gamma_16_to_1 = png_ptr->gamma_16_to_1; 3349| 5.69k| int gamma_shift = png_ptr->gamma_shift; 3350| 5.69k| int optimize = (png_ptr->flags & PNG_FLAG_OPTIMIZE_ALPHA) != 0; ------------------ | | 708| 5.69k|#define PNG_FLAG_OPTIMIZE_ALPHA 0x2000U /* Added to libpng-1.5.4 */ ------------------ 3351| 5.69k|#endif 3352| | 3353| 5.69k| png_bytep sp; 3354| 5.69k| png_uint_32 i; 3355| 5.69k| png_uint_32 row_width = row_info->width; 3356| 5.69k| int shift; 3357| | 3358| 5.69k| png_debug(1, "in png_do_compose"); ------------------ | | 145| 5.69k|# define png_debug(l, m) ((void)0) ------------------ 3359| | 3360| 5.69k| switch (row_info->color_type) 3361| 5.69k| { 3362| 1.85k| case PNG_COLOR_TYPE_GRAY: ------------------ | | 666| 1.85k|#define PNG_COLOR_TYPE_GRAY 0 ------------------ | Branch (3362:7): [True: 1.85k, False: 3.84k] ------------------ 3363| 1.85k| { 3364| 1.85k| switch (row_info->bit_depth) 3365| 1.85k| { 3366| 369| case 1: ------------------ | Branch (3366:13): [True: 369, False: 1.48k] ------------------ 3367| 369| { 3368| 369| sp = row; 3369| 369| shift = 7; 3370| 5.42k| for (i = 0; i < row_width; i++) ------------------ | Branch (3370:28): [True: 5.05k, False: 369] ------------------ 3371| 5.05k| { 3372| 5.05k| if ((png_uint_16)((*sp >> shift) & 0x01) ------------------ | Branch (3372:23): [True: 3.24k, False: 1.80k] ------------------ 3373| 5.05k| == png_ptr->trans_color.gray) 3374| 3.24k| { 3375| 3.24k| unsigned int tmp = *sp & (0x7f7f >> (7 - shift)); 3376| 3.24k| tmp |= 3377| 3.24k| (unsigned int)(png_ptr->background.gray << shift); 3378| 3.24k| *sp = (png_byte)(tmp & 0xff); 3379| 3.24k| } 3380| | 3381| 5.05k| if (shift == 0) ------------------ | Branch (3381:23): [True: 541, False: 4.51k] ------------------ 3382| 541| { 3383| 541| shift = 7; 3384| 541| sp++; 3385| 541| } 3386| | 3387| 4.51k| else 3388| 4.51k| shift--; 3389| 5.05k| } 3390| 369| break; 3391| 0| } 3392| | 3393| 371| case 2: ------------------ | Branch (3393:13): [True: 371, False: 1.48k] ------------------ 3394| 371| { 3395| 371|#ifdef PNG_READ_GAMMA_SUPPORTED 3396| 371| if (gamma_table != NULL) ------------------ | Branch (3396:20): [True: 166, False: 205] ------------------ 3397| 166| { 3398| 166| sp = row; 3399| 166| shift = 6; 3400| 1.89k| for (i = 0; i < row_width; i++) ------------------ | Branch (3400:31): [True: 1.72k, False: 166] ------------------ 3401| 1.72k| { 3402| 1.72k| if ((png_uint_16)((*sp >> shift) & 0x03) ------------------ | Branch (3402:26): [True: 1.07k, False: 655] ------------------ 3403| 1.72k| == png_ptr->trans_color.gray) 3404| 1.07k| { 3405| 1.07k| unsigned int tmp = *sp & (0x3f3f >> (6 - shift)); 3406| 1.07k| tmp |= 3407| 1.07k| (unsigned int)png_ptr->background.gray << shift; 3408| 1.07k| *sp = (png_byte)(tmp & 0xff); 3409| 1.07k| } 3410| | 3411| 655| else 3412| 655| { 3413| 655| unsigned int p = (*sp >> shift) & 0x03; 3414| 655| unsigned int g = (gamma_table [p | (p << 2) | 3415| 655| (p << 4) | (p << 6)] >> 6) & 0x03; 3416| 655| unsigned int tmp = *sp & (0x3f3f >> (6 - shift)); 3417| 655| tmp |= (unsigned int)(g << shift); 3418| 655| *sp = (png_byte)(tmp & 0xff); 3419| 655| } 3420| | 3421| 1.72k| if (shift == 0) ------------------ | Branch (3421:26): [True: 404, False: 1.32k] ------------------ 3422| 404| { 3423| 404| shift = 6; 3424| 404| sp++; 3425| 404| } 3426| | 3427| 1.32k| else 3428| 1.32k| shift -= 2; 3429| 1.72k| } 3430| 166| } 3431| | 3432| 205| else 3433| 205|#endif 3434| 205| { 3435| 205| sp = row; 3436| 205| shift = 6; 3437| 2.75k| for (i = 0; i < row_width; i++) ------------------ | Branch (3437:31): [True: 2.55k, False: 205] ------------------ 3438| 2.55k| { 3439| 2.55k| if ((png_uint_16)((*sp >> shift) & 0x03) ------------------ | Branch (3439:26): [True: 1.55k, False: 993] ------------------ 3440| 2.55k| == png_ptr->trans_color.gray) 3441| 1.55k| { 3442| 1.55k| unsigned int tmp = *sp & (0x3f3f >> (6 - shift)); 3443| 1.55k| tmp |= 3444| 1.55k| (unsigned int)png_ptr->background.gray << shift; 3445| 1.55k| *sp = (png_byte)(tmp & 0xff); 3446| 1.55k| } 3447| | 3448| 2.55k| if (shift == 0) ------------------ | Branch (3448:26): [True: 609, False: 1.94k] ------------------ 3449| 609| { 3450| 609| shift = 6; 3451| 609| sp++; 3452| 609| } 3453| | 3454| 1.94k| else 3455| 1.94k| shift -= 2; 3456| 2.55k| } 3457| 205| } 3458| 371| break; 3459| 0| } 3460| | 3461| 323| case 4: ------------------ | Branch (3461:13): [True: 323, False: 1.52k] ------------------ 3462| 323| { 3463| 323|#ifdef PNG_READ_GAMMA_SUPPORTED 3464| 323| if (gamma_table != NULL) ------------------ | Branch (3464:20): [True: 199, False: 124] ------------------ 3465| 199| { 3466| 199| sp = row; 3467| 199| shift = 4; 3468| 1.83k| for (i = 0; i < row_width; i++) ------------------ | Branch (3468:31): [True: 1.63k, False: 199] ------------------ 3469| 1.63k| { 3470| 1.63k| if ((png_uint_16)((*sp >> shift) & 0x0f) ------------------ | Branch (3470:26): [True: 789, False: 845] ------------------ 3471| 1.63k| == png_ptr->trans_color.gray) 3472| 789| { 3473| 789| unsigned int tmp = *sp & (0x0f0f >> (4 - shift)); 3474| 789| tmp |= 3475| 789| (unsigned int)(png_ptr->background.gray << shift); 3476| 789| *sp = (png_byte)(tmp & 0xff); 3477| 789| } 3478| | 3479| 845| else 3480| 845| { 3481| 845| unsigned int p = (*sp >> shift) & 0x0f; 3482| 845| unsigned int g = (gamma_table[p | (p << 4)] >> 4) & 3483| 845| 0x0f; 3484| 845| unsigned int tmp = *sp & (0x0f0f >> (4 - shift)); 3485| 845| tmp |= (unsigned int)(g << shift); 3486| 845| *sp = (png_byte)(tmp & 0xff); 3487| 845| } 3488| | 3489| 1.63k| if (shift == 0) ------------------ | Branch (3489:26): [True: 817, False: 817] ------------------ 3490| 817| { 3491| 817| shift = 4; 3492| 817| sp++; 3493| 817| } 3494| | 3495| 817| else 3496| 817| shift -= 4; 3497| 1.63k| } 3498| 199| } 3499| | 3500| 124| else 3501| 124|#endif 3502| 124| { 3503| 124| sp = row; 3504| 124| shift = 4; 3505| 1.27k| for (i = 0; i < row_width; i++) ------------------ | Branch (3505:31): [True: 1.14k, False: 124] ------------------ 3506| 1.14k| { 3507| 1.14k| if ((png_uint_16)((*sp >> shift) & 0x0f) ------------------ | Branch (3507:26): [True: 483, False: 663] ------------------ 3508| 1.14k| == png_ptr->trans_color.gray) 3509| 483| { 3510| 483| unsigned int tmp = *sp & (0x0f0f >> (4 - shift)); 3511| 483| tmp |= 3512| 483| (unsigned int)(png_ptr->background.gray << shift); 3513| 483| *sp = (png_byte)(tmp & 0xff); 3514| 483| } 3515| | 3516| 1.14k| if (shift == 0) ------------------ | Branch (3516:26): [True: 573, False: 573] ------------------ 3517| 573| { 3518| 573| shift = 4; 3519| 573| sp++; 3520| 573| } 3521| | 3522| 573| else 3523| 573| shift -= 4; 3524| 1.14k| } 3525| 124| } 3526| 323| break; 3527| 0| } 3528| | 3529| 431| case 8: ------------------ | Branch (3529:13): [True: 431, False: 1.42k] ------------------ 3530| 431| { 3531| 431|#ifdef PNG_READ_GAMMA_SUPPORTED 3532| 431| if (gamma_table != NULL) ------------------ | Branch (3532:20): [True: 226, False: 205] ------------------ 3533| 226| { 3534| 226| sp = row; 3535| 1.38k| for (i = 0; i < row_width; i++, sp++) ------------------ | Branch (3535:31): [True: 1.16k, False: 226] ------------------ 3536| 1.16k| { 3537| 1.16k| if (*sp == png_ptr->trans_color.gray) ------------------ | Branch (3537:26): [True: 274, False: 889] ------------------ 3538| 274| *sp = (png_byte)png_ptr->background.gray; 3539| | 3540| 889| else 3541| 889| *sp = gamma_table[*sp]; 3542| 1.16k| } 3543| 226| } 3544| 205| else 3545| 205|#endif 3546| 205| { 3547| 205| sp = row; 3548| 1.24k| for (i = 0; i < row_width; i++, sp++) ------------------ | Branch (3548:31): [True: 1.03k, False: 205] ------------------ 3549| 1.03k| { 3550| 1.03k| if (*sp == png_ptr->trans_color.gray) ------------------ | Branch (3550:26): [True: 371, False: 667] ------------------ 3551| 371| *sp = (png_byte)png_ptr->background.gray; 3552| 1.03k| } 3553| 205| } 3554| 431| break; 3555| 0| } 3556| | 3557| 357| case 16: ------------------ | Branch (3557:13): [True: 357, False: 1.49k] ------------------ 3558| 357| { 3559| 357|#ifdef PNG_READ_GAMMA_SUPPORTED 3560| 357| if (gamma_16 != NULL) ------------------ | Branch (3560:20): [True: 200, False: 157] ------------------ 3561| 200| { 3562| 200| sp = row; 3563| 1.69k| for (i = 0; i < row_width; i++, sp += 2) ------------------ | Branch (3563:31): [True: 1.49k, False: 200] ------------------ 3564| 1.49k| { 3565| 1.49k| png_uint_16 v; 3566| | 3567| 1.49k| v = (png_uint_16)(((*sp) << 8) + *(sp + 1)); 3568| | 3569| 1.49k| if (v == png_ptr->trans_color.gray) ------------------ | Branch (3569:26): [True: 333, False: 1.16k] ------------------ 3570| 333| { 3571| | /* Background is already in screen gamma */ 3572| 333| *sp = (png_byte)((png_ptr->background.gray >> 8) 3573| 333| & 0xff); 3574| 333| *(sp + 1) = (png_byte)(png_ptr->background.gray 3575| 333| & 0xff); 3576| 333| } 3577| | 3578| 1.16k| else 3579| 1.16k| { 3580| 1.16k| v = gamma_16[*(sp + 1) >> gamma_shift][*sp]; 3581| 1.16k| *sp = (png_byte)((v >> 8) & 0xff); 3582| 1.16k| *(sp + 1) = (png_byte)(v & 0xff); 3583| 1.16k| } 3584| 1.49k| } 3585| 200| } 3586| 157| else 3587| 157|#endif 3588| 157| { 3589| 157| sp = row; 3590| 926| for (i = 0; i < row_width; i++, sp += 2) ------------------ | Branch (3590:31): [True: 769, False: 157] ------------------ 3591| 769| { 3592| 769| png_uint_16 v; 3593| | 3594| 769| v = (png_uint_16)(((*sp) << 8) + *(sp + 1)); 3595| | 3596| 769| if (v == png_ptr->trans_color.gray) ------------------ | Branch (3596:26): [True: 352, False: 417] ------------------ 3597| 352| { 3598| 352| *sp = (png_byte)((png_ptr->background.gray >> 8) 3599| 352| & 0xff); 3600| 352| *(sp + 1) = (png_byte)(png_ptr->background.gray 3601| 352| & 0xff); 3602| 352| } 3603| 769| } 3604| 157| } 3605| 357| break; 3606| 0| } 3607| | 3608| 0| default: ------------------ | Branch (3608:13): [True: 0, False: 1.85k] ------------------ 3609| 0| break; 3610| 1.85k| } 3611| 1.85k| break; 3612| 1.85k| } 3613| | 3614| 1.85k| case PNG_COLOR_TYPE_RGB: ------------------ | | 668| 1.39k|#define PNG_COLOR_TYPE_RGB (PNG_COLOR_MASK_COLOR) | | ------------------ | | | | 662| 1.39k|#define PNG_COLOR_MASK_COLOR 2 | | ------------------ ------------------ | Branch (3614:7): [True: 1.39k, False: 4.30k] ------------------ 3615| 1.39k| { 3616| 1.39k| if (row_info->bit_depth == 8) ------------------ | Branch (3616:14): [True: 656, False: 741] ------------------ 3617| 656| { 3618| 656|#ifdef PNG_READ_GAMMA_SUPPORTED 3619| 656| if (gamma_table != NULL) ------------------ | Branch (3619:17): [True: 269, False: 387] ------------------ 3620| 269| { 3621| 269| sp = row; 3622| 27.8k| for (i = 0; i < row_width; i++, sp += 3) ------------------ | Branch (3622:28): [True: 27.6k, False: 269] ------------------ 3623| 27.6k| { 3624| 27.6k| if (*sp == png_ptr->trans_color.red && ------------------ | Branch (3624:23): [True: 4.75k, False: 22.8k] ------------------ 3625| 4.75k| *(sp + 1) == png_ptr->trans_color.green && ------------------ | Branch (3625:23): [True: 762, False: 3.99k] ------------------ 3626| 762| *(sp + 2) == png_ptr->trans_color.blue) ------------------ | Branch (3626:23): [True: 371, False: 391] ------------------ 3627| 371| { 3628| 371| *sp = (png_byte)png_ptr->background.red; 3629| 371| *(sp + 1) = (png_byte)png_ptr->background.green; 3630| 371| *(sp + 2) = (png_byte)png_ptr->background.blue; 3631| 371| } 3632| | 3633| 27.2k| else 3634| 27.2k| { 3635| 27.2k| *sp = gamma_table[*sp]; 3636| 27.2k| *(sp + 1) = gamma_table[*(sp + 1)]; 3637| 27.2k| *(sp + 2) = gamma_table[*(sp + 2)]; 3638| 27.2k| } 3639| 27.6k| } 3640| 269| } 3641| 387| else 3642| 387|#endif 3643| 387| { 3644| 387| sp = row; 3645| 43.9k| for (i = 0; i < row_width; i++, sp += 3) ------------------ | Branch (3645:28): [True: 43.5k, False: 387] ------------------ 3646| 43.5k| { 3647| 43.5k| if (*sp == png_ptr->trans_color.red && ------------------ | Branch (3647:23): [True: 8.82k, False: 34.7k] ------------------ 3648| 8.82k| *(sp + 1) == png_ptr->trans_color.green && ------------------ | Branch (3648:23): [True: 1.14k, False: 7.67k] ------------------ 3649| 1.14k| *(sp + 2) == png_ptr->trans_color.blue) ------------------ | Branch (3649:23): [True: 600, False: 547] ------------------ 3650| 600| { 3651| 600| *sp = (png_byte)png_ptr->background.red; 3652| 600| *(sp + 1) = (png_byte)png_ptr->background.green; 3653| 600| *(sp + 2) = (png_byte)png_ptr->background.blue; 3654| 600| } 3655| 43.5k| } 3656| 387| } 3657| 656| } 3658| 741| else /* if (row_info->bit_depth == 16) */ 3659| 741| { 3660| 741|#ifdef PNG_READ_GAMMA_SUPPORTED 3661| 741| if (gamma_16 != NULL) ------------------ | Branch (3661:17): [True: 349, False: 392] ------------------ 3662| 349| { 3663| 349| sp = row; 3664| 5.20k| for (i = 0; i < row_width; i++, sp += 6) ------------------ | Branch (3664:28): [True: 4.86k, False: 349] ------------------ 3665| 4.86k| { 3666| 4.86k| png_uint_16 r = (png_uint_16)(((*sp) << 8) + *(sp + 1)); 3667| | 3668| 4.86k| png_uint_16 g = (png_uint_16)(((*(sp + 2)) << 8) 3669| 4.86k| + *(sp + 3)); 3670| | 3671| 4.86k| png_uint_16 b = (png_uint_16)(((*(sp + 4)) << 8) 3672| 4.86k| + *(sp + 5)); 3673| | 3674| 4.86k| if (r == png_ptr->trans_color.red && ------------------ | Branch (3674:23): [True: 1.44k, False: 3.41k] ------------------ 3675| 1.44k| g == png_ptr->trans_color.green && ------------------ | Branch (3675:23): [True: 1.16k, False: 280] ------------------ 3676| 1.16k| b == png_ptr->trans_color.blue) ------------------ | Branch (3676:23): [True: 878, False: 285] ------------------ 3677| 878| { 3678| | /* Background is already in screen gamma */ 3679| 878| *sp = (png_byte)((png_ptr->background.red >> 8) & 0xff); 3680| 878| *(sp + 1) = (png_byte)(png_ptr->background.red & 0xff); 3681| 878| *(sp + 2) = (png_byte)((png_ptr->background.green >> 8) 3682| 878| & 0xff); 3683| 878| *(sp + 3) = (png_byte)(png_ptr->background.green 3684| 878| & 0xff); 3685| 878| *(sp + 4) = (png_byte)((png_ptr->background.blue >> 8) 3686| 878| & 0xff); 3687| 878| *(sp + 5) = (png_byte)(png_ptr->background.blue & 0xff); 3688| 878| } 3689| | 3690| 3.98k| else 3691| 3.98k| { 3692| 3.98k| png_uint_16 v = gamma_16[*(sp + 1) >> gamma_shift][*sp]; 3693| 3.98k| *sp = (png_byte)((v >> 8) & 0xff); 3694| 3.98k| *(sp + 1) = (png_byte)(v & 0xff); 3695| | 3696| 3.98k| v = gamma_16[*(sp + 3) >> gamma_shift][*(sp + 2)]; 3697| 3.98k| *(sp + 2) = (png_byte)((v >> 8) & 0xff); 3698| 3.98k| *(sp + 3) = (png_byte)(v & 0xff); 3699| | 3700| 3.98k| v = gamma_16[*(sp + 5) >> gamma_shift][*(sp + 4)]; 3701| 3.98k| *(sp + 4) = (png_byte)((v >> 8) & 0xff); 3702| 3.98k| *(sp + 5) = (png_byte)(v & 0xff); 3703| 3.98k| } 3704| 4.86k| } 3705| 349| } 3706| | 3707| 392| else 3708| 392|#endif 3709| 392| { 3710| 392| sp = row; 3711| 7.66k| for (i = 0; i < row_width; i++, sp += 6) ------------------ | Branch (3711:28): [True: 7.27k, False: 392] ------------------ 3712| 7.27k| { 3713| 7.27k| png_uint_16 r = (png_uint_16)(((*sp) << 8) + *(sp + 1)); 3714| | 3715| 7.27k| png_uint_16 g = (png_uint_16)(((*(sp + 2)) << 8) 3716| 7.27k| + *(sp + 3)); 3717| | 3718| 7.27k| png_uint_16 b = (png_uint_16)(((*(sp + 4)) << 8) 3719| 7.27k| + *(sp + 5)); 3720| | 3721| 7.27k| if (r == png_ptr->trans_color.red && ------------------ | Branch (3721:23): [True: 1.29k, False: 5.98k] ------------------ 3722| 1.29k| g == png_ptr->trans_color.green && ------------------ | Branch (3722:23): [True: 1.03k, False: 264] ------------------ 3723| 1.03k| b == png_ptr->trans_color.blue) ------------------ | Branch (3723:23): [True: 754, False: 278] ------------------ 3724| 754| { 3725| 754| *sp = (png_byte)((png_ptr->background.red >> 8) & 0xff); 3726| 754| *(sp + 1) = (png_byte)(png_ptr->background.red & 0xff); 3727| 754| *(sp + 2) = (png_byte)((png_ptr->background.green >> 8) 3728| 754| & 0xff); 3729| 754| *(sp + 3) = (png_byte)(png_ptr->background.green 3730| 754| & 0xff); 3731| 754| *(sp + 4) = (png_byte)((png_ptr->background.blue >> 8) 3732| 754| & 0xff); 3733| 754| *(sp + 5) = (png_byte)(png_ptr->background.blue & 0xff); 3734| 754| } 3735| 7.27k| } 3736| 392| } 3737| 741| } 3738| 1.39k| break; 3739| 1.85k| } 3740| | 3741| 925| case PNG_COLOR_TYPE_GRAY_ALPHA: ------------------ | | 670| 925|#define PNG_COLOR_TYPE_GRAY_ALPHA (PNG_COLOR_MASK_ALPHA) | | ------------------ | | | | 663| 925|#define PNG_COLOR_MASK_ALPHA 4 | | ------------------ ------------------ | Branch (3741:7): [True: 925, False: 4.77k] ------------------ 3742| 925| { 3743| 925| if (row_info->bit_depth == 8) ------------------ | Branch (3743:14): [True: 518, False: 407] ------------------ 3744| 518| { 3745| 518|#ifdef PNG_READ_GAMMA_SUPPORTED 3746| 518| if (gamma_to_1 != NULL && gamma_from_1 != NULL && ------------------ | Branch (3746:17): [True: 255, False: 263] | Branch (3746:39): [True: 255, False: 0] ------------------ 3747| 255| gamma_table != NULL) ------------------ | Branch (3747:17): [True: 255, False: 0] ------------------ 3748| 255| { 3749| 255| sp = row; 3750| 2.30k| for (i = 0; i < row_width; i++, sp += 2) ------------------ | Branch (3750:28): [True: 2.05k, False: 255] ------------------ 3751| 2.05k| { 3752| 2.05k| png_uint_16 a = *(sp + 1); 3753| | 3754| 2.05k| if (a == 0xff) ------------------ | Branch (3754:23): [True: 219, False: 1.83k] ------------------ 3755| 219| *sp = gamma_table[*sp]; 3756| | 3757| 1.83k| else if (a == 0) ------------------ | Branch (3757:28): [True: 459, False: 1.37k] ------------------ 3758| 459| { 3759| | /* Background is already in screen gamma */ 3760| 459| *sp = (png_byte)png_ptr->background.gray; 3761| 459| } 3762| | 3763| 1.37k| else 3764| 1.37k| { 3765| 1.37k| png_byte v, w; 3766| | 3767| 1.37k| v = gamma_to_1[*sp]; 3768| 1.37k| png_composite(w, v, a, png_ptr->background_1.gray); ------------------ | | 2752| 1.37k| { \ | | 2753| 1.37k| png_uint_16 temp = (png_uint_16)((png_uint_16)(fg) \ | | 2754| 1.37k| * (png_uint_16)(alpha) \ | | 2755| 1.37k| + (png_uint_16)(bg)*(png_uint_16)(255 \ | | 2756| 1.37k| - (png_uint_16)(alpha)) + 128); \ | | 2757| 1.37k| (composite) = (png_byte)(((temp + (temp >> 8)) >> 8) & 0xff); \ | | 2758| 1.37k| } ------------------ 3769| 1.37k| if (optimize == 0) ------------------ | Branch (3769:26): [True: 1.37k, False: 0] ------------------ 3770| 1.37k| w = gamma_from_1[w]; 3771| 1.37k| *sp = w; 3772| 1.37k| } 3773| 2.05k| } 3774| 255| } 3775| 263| else 3776| 263|#endif 3777| 263| { 3778| 263| sp = row; 3779| 5.72k| for (i = 0; i < row_width; i++, sp += 2) ------------------ | Branch (3779:28): [True: 5.46k, False: 263] ------------------ 3780| 5.46k| { 3781| 5.46k| png_byte a = *(sp + 1); 3782| | 3783| 5.46k| if (a == 0) ------------------ | Branch (3783:23): [True: 2.59k, False: 2.87k] ------------------ 3784| 2.59k| *sp = (png_byte)png_ptr->background.gray; 3785| | 3786| 2.87k| else if (a < 0xff) ------------------ | Branch (3786:28): [True: 2.66k, False: 209] ------------------ 3787| 2.66k| png_composite(*sp, *sp, a, png_ptr->background.gray); ------------------ | | 2752| 2.66k| { \ | | 2753| 2.66k| png_uint_16 temp = (png_uint_16)((png_uint_16)(fg) \ | | 2754| 2.66k| * (png_uint_16)(alpha) \ | | 2755| 2.66k| + (png_uint_16)(bg)*(png_uint_16)(255 \ | | 2756| 2.66k| - (png_uint_16)(alpha)) + 128); \ | | 2757| 2.66k| (composite) = (png_byte)(((temp + (temp >> 8)) >> 8) & 0xff); \ | | 2758| 2.66k| } ------------------ 3788| 5.46k| } 3789| 263| } 3790| 518| } 3791| 407| else /* if (png_ptr->bit_depth == 16) */ 3792| 407| { 3793| 407|#ifdef PNG_READ_GAMMA_SUPPORTED 3794| 407| if (gamma_16 != NULL && gamma_16_from_1 != NULL && ------------------ | Branch (3794:17): [True: 182, False: 225] | Branch (3794:37): [True: 182, False: 0] ------------------ 3795| 182| gamma_16_to_1 != NULL) ------------------ | Branch (3795:17): [True: 182, False: 0] ------------------ 3796| 182| { 3797| 182| sp = row; 3798| 12.7k| for (i = 0; i < row_width; i++, sp += 4) ------------------ | Branch (3798:28): [True: 12.6k, False: 182] ------------------ 3799| 12.6k| { 3800| 12.6k| png_uint_16 a = (png_uint_16)(((*(sp + 2)) << 8) 3801| 12.6k| + *(sp + 3)); 3802| | 3803| 12.6k| if (a == (png_uint_16)0xffff) ------------------ | Branch (3803:23): [True: 217, False: 12.3k] ------------------ 3804| 217| { 3805| 217| png_uint_16 v; 3806| | 3807| 217| v = gamma_16[*(sp + 1) >> gamma_shift][*sp]; 3808| 217| *sp = (png_byte)((v >> 8) & 0xff); 3809| 217| *(sp + 1) = (png_byte)(v & 0xff); 3810| 217| } 3811| | 3812| 12.3k| else if (a == 0) ------------------ | Branch (3812:28): [True: 450, False: 11.9k] ------------------ 3813| 450| { 3814| | /* Background is already in screen gamma */ 3815| 450| *sp = (png_byte)((png_ptr->background.gray >> 8) 3816| 450| & 0xff); 3817| 450| *(sp + 1) = (png_byte)(png_ptr->background.gray & 0xff); 3818| 450| } 3819| | 3820| 11.9k| else 3821| 11.9k| { 3822| 11.9k| png_uint_16 g, v, w; 3823| | 3824| 11.9k| g = gamma_16_to_1[*(sp + 1) >> gamma_shift][*sp]; 3825| 11.9k| png_composite_16(v, g, a, png_ptr->background_1.gray); ------------------ | | 2761| 11.9k| { \ | | 2762| 11.9k| png_uint_32 temp = (png_uint_32)((png_uint_32)(fg) \ | | 2763| 11.9k| * (png_uint_32)(alpha) \ | | 2764| 11.9k| + (png_uint_32)(bg)*(65535 \ | | 2765| 11.9k| - (png_uint_32)(alpha)) + 32768); \ | | 2766| 11.9k| (composite) = (png_uint_16)(0xffff & ((temp + (temp >> 16)) >> 16)); \ | | 2767| 11.9k| } ------------------ 3826| 11.9k| if (optimize != 0) ------------------ | Branch (3826:26): [True: 0, False: 11.9k] ------------------ 3827| 0| w = v; 3828| 11.9k| else 3829| 11.9k| w = gamma_16_from_1[(v & 0xff) >> 3830| 11.9k| gamma_shift][v >> 8]; 3831| 11.9k| *sp = (png_byte)((w >> 8) & 0xff); 3832| 11.9k| *(sp + 1) = (png_byte)(w & 0xff); 3833| 11.9k| } 3834| 12.6k| } 3835| 182| } 3836| 225| else 3837| 225|#endif 3838| 225| { 3839| 225| sp = row; 3840| 11.4k| for (i = 0; i < row_width; i++, sp += 4) ------------------ | Branch (3840:28): [True: 11.2k, False: 225] ------------------ 3841| 11.2k| { 3842| 11.2k| png_uint_16 a = (png_uint_16)(((*(sp + 2)) << 8) 3843| 11.2k| + *(sp + 3)); 3844| | 3845| 11.2k| if (a == 0) ------------------ | Branch (3845:23): [True: 1.55k, False: 9.68k] ------------------ 3846| 1.55k| { 3847| 1.55k| *sp = (png_byte)((png_ptr->background.gray >> 8) 3848| 1.55k| & 0xff); 3849| 1.55k| *(sp + 1) = (png_byte)(png_ptr->background.gray & 0xff); 3850| 1.55k| } 3851| | 3852| 9.68k| else if (a < 0xffff) ------------------ | Branch (3852:28): [True: 9.40k, False: 284] ------------------ 3853| 9.40k| { 3854| 9.40k| png_uint_16 g, v; 3855| | 3856| 9.40k| g = (png_uint_16)(((*sp) << 8) + *(sp + 1)); 3857| 9.40k| png_composite_16(v, g, a, png_ptr->background.gray); ------------------ | | 2761| 9.40k| { \ | | 2762| 9.40k| png_uint_32 temp = (png_uint_32)((png_uint_32)(fg) \ | | 2763| 9.40k| * (png_uint_32)(alpha) \ | | 2764| 9.40k| + (png_uint_32)(bg)*(65535 \ | | 2765| 9.40k| - (png_uint_32)(alpha)) + 32768); \ | | 2766| 9.40k| (composite) = (png_uint_16)(0xffff & ((temp + (temp >> 16)) >> 16)); \ | | 2767| 9.40k| } ------------------ 3858| 9.40k| *sp = (png_byte)((v >> 8) & 0xff); 3859| 9.40k| *(sp + 1) = (png_byte)(v & 0xff); 3860| 9.40k| } 3861| 11.2k| } 3862| 225| } 3863| 407| } 3864| 925| break; 3865| 1.85k| } 3866| | 3867| 1.52k| case PNG_COLOR_TYPE_RGB_ALPHA: ------------------ | | 669| 1.52k|#define PNG_COLOR_TYPE_RGB_ALPHA (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_ALPHA) | | ------------------ | | | | 662| 1.52k|#define PNG_COLOR_MASK_COLOR 2 | | ------------------ | | #define PNG_COLOR_TYPE_RGB_ALPHA (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_ALPHA) | | ------------------ | | | | 663| 1.52k|#define PNG_COLOR_MASK_ALPHA 4 | | ------------------ ------------------ | Branch (3867:7): [True: 1.52k, False: 4.17k] ------------------ 3868| 1.52k| { 3869| 1.52k| if (row_info->bit_depth == 8) ------------------ | Branch (3869:14): [True: 804, False: 720] ------------------ 3870| 804| { 3871| 804|#ifdef PNG_READ_GAMMA_SUPPORTED 3872| 804| if (gamma_to_1 != NULL && gamma_from_1 != NULL && ------------------ | Branch (3872:17): [True: 266, False: 538] | Branch (3872:39): [True: 266, False: 0] ------------------ 3873| 266| gamma_table != NULL) ------------------ | Branch (3873:17): [True: 266, False: 0] ------------------ 3874| 266| { 3875| 266| sp = row; 3876| 3.48k| for (i = 0; i < row_width; i++, sp += 4) ------------------ | Branch (3876:28): [True: 3.21k, False: 266] ------------------ 3877| 3.21k| { 3878| 3.21k| png_byte a = *(sp + 3); 3879| | 3880| 3.21k| if (a == 0xff) ------------------ | Branch (3880:23): [True: 211, False: 3.00k] ------------------ 3881| 211| { 3882| 211| *sp = gamma_table[*sp]; 3883| 211| *(sp + 1) = gamma_table[*(sp + 1)]; 3884| 211| *(sp + 2) = gamma_table[*(sp + 2)]; 3885| 211| } 3886| | 3887| 3.00k| else if (a == 0) ------------------ | Branch (3887:28): [True: 1.88k, False: 1.12k] ------------------ 3888| 1.88k| { 3889| | /* Background is already in screen gamma */ 3890| 1.88k| *sp = (png_byte)png_ptr->background.red; 3891| 1.88k| *(sp + 1) = (png_byte)png_ptr->background.green; 3892| 1.88k| *(sp + 2) = (png_byte)png_ptr->background.blue; 3893| 1.88k| } 3894| | 3895| 1.12k| else 3896| 1.12k| { 3897| 1.12k| png_byte v, w; 3898| | 3899| 1.12k| v = gamma_to_1[*sp]; 3900| 1.12k| png_composite(w, v, a, png_ptr->background_1.red); ------------------ | | 2752| 1.12k| { \ | | 2753| 1.12k| png_uint_16 temp = (png_uint_16)((png_uint_16)(fg) \ | | 2754| 1.12k| * (png_uint_16)(alpha) \ | | 2755| 1.12k| + (png_uint_16)(bg)*(png_uint_16)(255 \ | | 2756| 1.12k| - (png_uint_16)(alpha)) + 128); \ | | 2757| 1.12k| (composite) = (png_byte)(((temp + (temp >> 8)) >> 8) & 0xff); \ | | 2758| 1.12k| } ------------------ 3901| 1.12k| if (optimize == 0) w = gamma_from_1[w]; ------------------ | Branch (3901:26): [True: 1.12k, False: 0] ------------------ 3902| 1.12k| *sp = w; 3903| | 3904| 1.12k| v = gamma_to_1[*(sp + 1)]; 3905| 1.12k| png_composite(w, v, a, png_ptr->background_1.green); ------------------ | | 2752| 1.12k| { \ | | 2753| 1.12k| png_uint_16 temp = (png_uint_16)((png_uint_16)(fg) \ | | 2754| 1.12k| * (png_uint_16)(alpha) \ | | 2755| 1.12k| + (png_uint_16)(bg)*(png_uint_16)(255 \ | | 2756| 1.12k| - (png_uint_16)(alpha)) + 128); \ | | 2757| 1.12k| (composite) = (png_byte)(((temp + (temp >> 8)) >> 8) & 0xff); \ | | 2758| 1.12k| } ------------------ 3906| 1.12k| if (optimize == 0) w = gamma_from_1[w]; ------------------ | Branch (3906:26): [True: 1.12k, False: 0] ------------------ 3907| 1.12k| *(sp + 1) = w; 3908| | 3909| 1.12k| v = gamma_to_1[*(sp + 2)]; 3910| 1.12k| png_composite(w, v, a, png_ptr->background_1.blue); ------------------ | | 2752| 1.12k| { \ | | 2753| 1.12k| png_uint_16 temp = (png_uint_16)((png_uint_16)(fg) \ | | 2754| 1.12k| * (png_uint_16)(alpha) \ | | 2755| 1.12k| + (png_uint_16)(bg)*(png_uint_16)(255 \ | | 2756| 1.12k| - (png_uint_16)(alpha)) + 128); \ | | 2757| 1.12k| (composite) = (png_byte)(((temp + (temp >> 8)) >> 8) & 0xff); \ | | 2758| 1.12k| } ------------------ 3911| 1.12k| if (optimize == 0) w = gamma_from_1[w]; ------------------ | Branch (3911:26): [True: 1.12k, False: 0] ------------------ 3912| 1.12k| *(sp + 2) = w; 3913| 1.12k| } 3914| 3.21k| } 3915| 266| } 3916| 538| else 3917| 538|#endif 3918| 538| { 3919| 538| sp = row; 3920| 42.8k| for (i = 0; i < row_width; i++, sp += 4) ------------------ | Branch (3920:28): [True: 42.3k, False: 538] ------------------ 3921| 42.3k| { 3922| 42.3k| png_byte a = *(sp + 3); 3923| | 3924| 42.3k| if (a == 0) ------------------ | Branch (3924:23): [True: 5.03k, False: 37.3k] ------------------ 3925| 5.03k| { 3926| 5.03k| *sp = (png_byte)png_ptr->background.red; 3927| 5.03k| *(sp + 1) = (png_byte)png_ptr->background.green; 3928| 5.03k| *(sp + 2) = (png_byte)png_ptr->background.blue; 3929| 5.03k| } 3930| | 3931| 37.3k| else if (a < 0xff) ------------------ | Branch (3931:28): [True: 37.0k, False: 285] ------------------ 3932| 37.0k| { 3933| 37.0k| png_composite(*sp, *sp, a, png_ptr->background.red); ------------------ | | 2752| 37.0k| { \ | | 2753| 37.0k| png_uint_16 temp = (png_uint_16)((png_uint_16)(fg) \ | | 2754| 37.0k| * (png_uint_16)(alpha) \ | | 2755| 37.0k| + (png_uint_16)(bg)*(png_uint_16)(255 \ | | 2756| 37.0k| - (png_uint_16)(alpha)) + 128); \ | | 2757| 37.0k| (composite) = (png_byte)(((temp + (temp >> 8)) >> 8) & 0xff); \ | | 2758| 37.0k| } ------------------ 3934| | 3935| 37.0k| png_composite(*(sp + 1), *(sp + 1), a, ------------------ | | 2752| 37.0k| { \ | | 2753| 37.0k| png_uint_16 temp = (png_uint_16)((png_uint_16)(fg) \ | | 2754| 37.0k| * (png_uint_16)(alpha) \ | | 2755| 37.0k| + (png_uint_16)(bg)*(png_uint_16)(255 \ | | 2756| 37.0k| - (png_uint_16)(alpha)) + 128); \ | | 2757| 37.0k| (composite) = (png_byte)(((temp + (temp >> 8)) >> 8) & 0xff); \ | | 2758| 37.0k| } ------------------ 3936| 37.0k| png_ptr->background.green); 3937| | 3938| 37.0k| png_composite(*(sp + 2), *(sp + 2), a, ------------------ | | 2752| 37.0k| { \ | | 2753| 37.0k| png_uint_16 temp = (png_uint_16)((png_uint_16)(fg) \ | | 2754| 37.0k| * (png_uint_16)(alpha) \ | | 2755| 37.0k| + (png_uint_16)(bg)*(png_uint_16)(255 \ | | 2756| 37.0k| - (png_uint_16)(alpha)) + 128); \ | | 2757| 37.0k| (composite) = (png_byte)(((temp + (temp >> 8)) >> 8) & 0xff); \ | | 2758| 37.0k| } ------------------ 3939| 37.0k| png_ptr->background.blue); 3940| 37.0k| } 3941| 42.3k| } 3942| 538| } 3943| 804| } 3944| 720| else /* if (row_info->bit_depth == 16) */ 3945| 720| { 3946| 720|#ifdef PNG_READ_GAMMA_SUPPORTED 3947| 720| if (gamma_16 != NULL && gamma_16_from_1 != NULL && ------------------ | Branch (3947:17): [True: 247, False: 473] | Branch (3947:37): [True: 247, False: 0] ------------------ 3948| 247| gamma_16_to_1 != NULL) ------------------ | Branch (3948:17): [True: 247, False: 0] ------------------ 3949| 247| { 3950| 247| sp = row; 3951| 3.52k| for (i = 0; i < row_width; i++, sp += 8) ------------------ | Branch (3951:28): [True: 3.28k, False: 247] ------------------ 3952| 3.28k| { 3953| 3.28k| png_uint_16 a = (png_uint_16)(((png_uint_16)(*(sp + 6)) 3954| 3.28k| << 8) + (png_uint_16)(*(sp + 7))); 3955| | 3956| 3.28k| if (a == (png_uint_16)0xffff) ------------------ | Branch (3956:23): [True: 224, False: 3.05k] ------------------ 3957| 224| { 3958| 224| png_uint_16 v; 3959| | 3960| 224| v = gamma_16[*(sp + 1) >> gamma_shift][*sp]; 3961| 224| *sp = (png_byte)((v >> 8) & 0xff); 3962| 224| *(sp + 1) = (png_byte)(v & 0xff); 3963| | 3964| 224| v = gamma_16[*(sp + 3) >> gamma_shift][*(sp + 2)]; 3965| 224| *(sp + 2) = (png_byte)((v >> 8) & 0xff); 3966| 224| *(sp + 3) = (png_byte)(v & 0xff); 3967| | 3968| 224| v = gamma_16[*(sp + 5) >> gamma_shift][*(sp + 4)]; 3969| 224| *(sp + 4) = (png_byte)((v >> 8) & 0xff); 3970| 224| *(sp + 5) = (png_byte)(v & 0xff); 3971| 224| } 3972| | 3973| 3.05k| else if (a == 0) ------------------ | Branch (3973:28): [True: 917, False: 2.13k] ------------------ 3974| 917| { 3975| | /* Background is already in screen gamma */ 3976| 917| *sp = (png_byte)((png_ptr->background.red >> 8) & 0xff); 3977| 917| *(sp + 1) = (png_byte)(png_ptr->background.red & 0xff); 3978| 917| *(sp + 2) = (png_byte)((png_ptr->background.green >> 8) 3979| 917| & 0xff); 3980| 917| *(sp + 3) = (png_byte)(png_ptr->background.green 3981| 917| & 0xff); 3982| 917| *(sp + 4) = (png_byte)((png_ptr->background.blue >> 8) 3983| 917| & 0xff); 3984| 917| *(sp + 5) = (png_byte)(png_ptr->background.blue & 0xff); 3985| 917| } 3986| | 3987| 2.13k| else 3988| 2.13k| { 3989| 2.13k| png_uint_16 v, w; 3990| | 3991| 2.13k| v = gamma_16_to_1[*(sp + 1) >> gamma_shift][*sp]; 3992| 2.13k| png_composite_16(w, v, a, png_ptr->background_1.red); ------------------ | | 2761| 2.13k| { \ | | 2762| 2.13k| png_uint_32 temp = (png_uint_32)((png_uint_32)(fg) \ | | 2763| 2.13k| * (png_uint_32)(alpha) \ | | 2764| 2.13k| + (png_uint_32)(bg)*(65535 \ | | 2765| 2.13k| - (png_uint_32)(alpha)) + 32768); \ | | 2766| 2.13k| (composite) = (png_uint_16)(0xffff & ((temp + (temp >> 16)) >> 16)); \ | | 2767| 2.13k| } ------------------ 3993| 2.13k| if (optimize == 0) ------------------ | Branch (3993:26): [True: 2.13k, False: 0] ------------------ 3994| 2.13k| w = gamma_16_from_1[((w & 0xff) >> gamma_shift)][w >> 3995| 2.13k| 8]; 3996| 2.13k| *sp = (png_byte)((w >> 8) & 0xff); 3997| 2.13k| *(sp + 1) = (png_byte)(w & 0xff); 3998| | 3999| 2.13k| v = gamma_16_to_1[*(sp + 3) >> gamma_shift][*(sp + 2)]; 4000| 2.13k| png_composite_16(w, v, a, png_ptr->background_1.green); ------------------ | | 2761| 2.13k| { \ | | 2762| 2.13k| png_uint_32 temp = (png_uint_32)((png_uint_32)(fg) \ | | 2763| 2.13k| * (png_uint_32)(alpha) \ | | 2764| 2.13k| + (png_uint_32)(bg)*(65535 \ | | 2765| 2.13k| - (png_uint_32)(alpha)) + 32768); \ | | 2766| 2.13k| (composite) = (png_uint_16)(0xffff & ((temp + (temp >> 16)) >> 16)); \ | | 2767| 2.13k| } ------------------ 4001| 2.13k| if (optimize == 0) ------------------ | Branch (4001:26): [True: 2.13k, False: 0] ------------------ 4002| 2.13k| w = gamma_16_from_1[((w & 0xff) >> gamma_shift)][w >> 4003| 2.13k| 8]; 4004| | 4005| 2.13k| *(sp + 2) = (png_byte)((w >> 8) & 0xff); 4006| 2.13k| *(sp + 3) = (png_byte)(w & 0xff); 4007| | 4008| 2.13k| v = gamma_16_to_1[*(sp + 5) >> gamma_shift][*(sp + 4)]; 4009| 2.13k| png_composite_16(w, v, a, png_ptr->background_1.blue); ------------------ | | 2761| 2.13k| { \ | | 2762| 2.13k| png_uint_32 temp = (png_uint_32)((png_uint_32)(fg) \ | | 2763| 2.13k| * (png_uint_32)(alpha) \ | | 2764| 2.13k| + (png_uint_32)(bg)*(65535 \ | | 2765| 2.13k| - (png_uint_32)(alpha)) + 32768); \ | | 2766| 2.13k| (composite) = (png_uint_16)(0xffff & ((temp + (temp >> 16)) >> 16)); \ | | 2767| 2.13k| } ------------------ 4010| 2.13k| if (optimize == 0) ------------------ | Branch (4010:26): [True: 2.13k, False: 0] ------------------ 4011| 2.13k| w = gamma_16_from_1[((w & 0xff) >> gamma_shift)][w >> 4012| 2.13k| 8]; 4013| | 4014| 2.13k| *(sp + 4) = (png_byte)((w >> 8) & 0xff); 4015| 2.13k| *(sp + 5) = (png_byte)(w & 0xff); 4016| 2.13k| } 4017| 3.28k| } 4018| 247| } 4019| | 4020| 473| else 4021| 473|#endif 4022| 473| { 4023| 473| sp = row; 4024| 53.0k| for (i = 0; i < row_width; i++, sp += 8) ------------------ | Branch (4024:28): [True: 52.5k, False: 473] ------------------ 4025| 52.5k| { 4026| 52.5k| png_uint_16 a = (png_uint_16)(((png_uint_16)(*(sp + 6)) 4027| 52.5k| << 8) + (png_uint_16)(*(sp + 7))); 4028| | 4029| 52.5k| if (a == 0) ------------------ | Branch (4029:23): [True: 1.09k, False: 51.4k] ------------------ 4030| 1.09k| { 4031| 1.09k| *sp = (png_byte)((png_ptr->background.red >> 8) & 0xff); 4032| 1.09k| *(sp + 1) = (png_byte)(png_ptr->background.red & 0xff); 4033| 1.09k| *(sp + 2) = (png_byte)((png_ptr->background.green >> 8) 4034| 1.09k| & 0xff); 4035| 1.09k| *(sp + 3) = (png_byte)(png_ptr->background.green 4036| 1.09k| & 0xff); 4037| 1.09k| *(sp + 4) = (png_byte)((png_ptr->background.blue >> 8) 4038| 1.09k| & 0xff); 4039| 1.09k| *(sp + 5) = (png_byte)(png_ptr->background.blue & 0xff); 4040| 1.09k| } 4041| | 4042| 51.4k| else if (a < 0xffff) ------------------ | Branch (4042:28): [True: 51.2k, False: 226] ------------------ 4043| 51.2k| { 4044| 51.2k| png_uint_16 v; 4045| | 4046| 51.2k| png_uint_16 r = (png_uint_16)(((*sp) << 8) + *(sp + 1)); 4047| 51.2k| png_uint_16 g = (png_uint_16)(((*(sp + 2)) << 8) 4048| 51.2k| + *(sp + 3)); 4049| 51.2k| png_uint_16 b = (png_uint_16)(((*(sp + 4)) << 8) 4050| 51.2k| + *(sp + 5)); 4051| | 4052| 51.2k| png_composite_16(v, r, a, png_ptr->background.red); ------------------ | | 2761| 51.2k| { \ | | 2762| 51.2k| png_uint_32 temp = (png_uint_32)((png_uint_32)(fg) \ | | 2763| 51.2k| * (png_uint_32)(alpha) \ | | 2764| 51.2k| + (png_uint_32)(bg)*(65535 \ | | 2765| 51.2k| - (png_uint_32)(alpha)) + 32768); \ | | 2766| 51.2k| (composite) = (png_uint_16)(0xffff & ((temp + (temp >> 16)) >> 16)); \ | | 2767| 51.2k| } ------------------ 4053| 51.2k| *sp = (png_byte)((v >> 8) & 0xff); 4054| 51.2k| *(sp + 1) = (png_byte)(v & 0xff); 4055| | 4056| 51.2k| png_composite_16(v, g, a, png_ptr->background.green); ------------------ | | 2761| 51.2k| { \ | | 2762| 51.2k| png_uint_32 temp = (png_uint_32)((png_uint_32)(fg) \ | | 2763| 51.2k| * (png_uint_32)(alpha) \ | | 2764| 51.2k| + (png_uint_32)(bg)*(65535 \ | | 2765| 51.2k| - (png_uint_32)(alpha)) + 32768); \ | | 2766| 51.2k| (composite) = (png_uint_16)(0xffff & ((temp + (temp >> 16)) >> 16)); \ | | 2767| 51.2k| } ------------------ 4057| 51.2k| *(sp + 2) = (png_byte)((v >> 8) & 0xff); 4058| 51.2k| *(sp + 3) = (png_byte)(v & 0xff); 4059| | 4060| 51.2k| png_composite_16(v, b, a, png_ptr->background.blue); ------------------ | | 2761| 51.2k| { \ | | 2762| 51.2k| png_uint_32 temp = (png_uint_32)((png_uint_32)(fg) \ | | 2763| 51.2k| * (png_uint_32)(alpha) \ | | 2764| 51.2k| + (png_uint_32)(bg)*(65535 \ | | 2765| 51.2k| - (png_uint_32)(alpha)) + 32768); \ | | 2766| 51.2k| (composite) = (png_uint_16)(0xffff & ((temp + (temp >> 16)) >> 16)); \ | | 2767| 51.2k| } ------------------ 4061| 51.2k| *(sp + 4) = (png_byte)((v >> 8) & 0xff); 4062| 51.2k| *(sp + 5) = (png_byte)(v & 0xff); 4063| 51.2k| } 4064| 52.5k| } 4065| 473| } 4066| 720| } 4067| 1.52k| break; 4068| 1.85k| } 4069| | 4070| 0| default: ------------------ | Branch (4070:7): [True: 0, False: 5.69k] ------------------ 4071| 0| break; 4072| 5.69k| } 4073| 5.69k|} pngrtran.c:png_do_gamma: 4085| 685|{ 4086| 685| png_const_bytep gamma_table = png_ptr->gamma_table; 4087| 685| png_const_uint_16pp gamma_16_table = png_ptr->gamma_16_table; 4088| 685| int gamma_shift = png_ptr->gamma_shift; 4089| | 4090| 685| png_bytep sp; 4091| 685| png_uint_32 i; 4092| 685| png_uint_32 row_width=row_info->width; 4093| | 4094| 685| png_debug(1, "in png_do_gamma"); ------------------ | | 145| 685|# define png_debug(l, m) ((void)0) ------------------ 4095| | 4096| 685| if (((row_info->bit_depth <= 8 && gamma_table != NULL) || ------------------ | Branch (4096:10): [True: 443, False: 242] | Branch (4096:38): [True: 443, False: 0] ------------------ 4097| 242| (row_info->bit_depth == 16 && gamma_16_table != NULL))) ------------------ | Branch (4097:9): [True: 242, False: 0] | Branch (4097:38): [True: 242, False: 0] ------------------ 4098| 685| { 4099| 685| switch (row_info->color_type) 4100| 685| { 4101| 200| case PNG_COLOR_TYPE_RGB: ------------------ | | 668| 200|#define PNG_COLOR_TYPE_RGB (PNG_COLOR_MASK_COLOR) | | ------------------ | | | | 662| 200|#define PNG_COLOR_MASK_COLOR 2 | | ------------------ ------------------ | Branch (4101:10): [True: 200, False: 485] ------------------ 4102| 200| { 4103| 200| if (row_info->bit_depth == 8) ------------------ | Branch (4103:17): [True: 89, False: 111] ------------------ 4104| 89| { 4105| 89| sp = row; 4106| 1.12k| for (i = 0; i < row_width; i++) ------------------ | Branch (4106:28): [True: 1.03k, False: 89] ------------------ 4107| 1.03k| { 4108| 1.03k| *sp = gamma_table[*sp]; 4109| 1.03k| sp++; 4110| 1.03k| *sp = gamma_table[*sp]; 4111| 1.03k| sp++; 4112| 1.03k| *sp = gamma_table[*sp]; 4113| 1.03k| sp++; 4114| 1.03k| } 4115| 89| } 4116| | 4117| 111| else /* if (row_info->bit_depth == 16) */ 4118| 111| { 4119| 111| sp = row; 4120| 1.79k| for (i = 0; i < row_width; i++) ------------------ | Branch (4120:28): [True: 1.68k, False: 111] ------------------ 4121| 1.68k| { 4122| 1.68k| png_uint_16 v; 4123| | 4124| 1.68k| v = gamma_16_table[*(sp + 1) >> gamma_shift][*sp]; 4125| 1.68k| *sp = (png_byte)((v >> 8) & 0xff); 4126| 1.68k| *(sp + 1) = (png_byte)(v & 0xff); 4127| 1.68k| sp += 2; 4128| | 4129| 1.68k| v = gamma_16_table[*(sp + 1) >> gamma_shift][*sp]; 4130| 1.68k| *sp = (png_byte)((v >> 8) & 0xff); 4131| 1.68k| *(sp + 1) = (png_byte)(v & 0xff); 4132| 1.68k| sp += 2; 4133| | 4134| 1.68k| v = gamma_16_table[*(sp + 1) >> gamma_shift][*sp]; 4135| 1.68k| *sp = (png_byte)((v >> 8) & 0xff); 4136| 1.68k| *(sp + 1) = (png_byte)(v & 0xff); 4137| 1.68k| sp += 2; 4138| 1.68k| } 4139| 111| } 4140| 200| break; 4141| 0| } 4142| | 4143| 0| case PNG_COLOR_TYPE_RGB_ALPHA: ------------------ | | 669| 0|#define PNG_COLOR_TYPE_RGB_ALPHA (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_ALPHA) | | ------------------ | | | | 662| 0|#define PNG_COLOR_MASK_COLOR 2 | | ------------------ | | #define PNG_COLOR_TYPE_RGB_ALPHA (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_ALPHA) | | ------------------ | | | | 663| 0|#define PNG_COLOR_MASK_ALPHA 4 | | ------------------ ------------------ | Branch (4143:10): [True: 0, False: 685] ------------------ 4144| 0| { 4145| 0| if (row_info->bit_depth == 8) ------------------ | Branch (4145:17): [True: 0, False: 0] ------------------ 4146| 0| { 4147| 0| sp = row; 4148| 0| for (i = 0; i < row_width; i++) ------------------ | Branch (4148:28): [True: 0, False: 0] ------------------ 4149| 0| { 4150| 0| *sp = gamma_table[*sp]; 4151| 0| sp++; 4152| | 4153| 0| *sp = gamma_table[*sp]; 4154| 0| sp++; 4155| | 4156| 0| *sp = gamma_table[*sp]; 4157| 0| sp++; 4158| | 4159| 0| sp++; 4160| 0| } 4161| 0| } 4162| | 4163| 0| else /* if (row_info->bit_depth == 16) */ 4164| 0| { 4165| 0| sp = row; 4166| 0| for (i = 0; i < row_width; i++) ------------------ | Branch (4166:28): [True: 0, False: 0] ------------------ 4167| 0| { 4168| 0| png_uint_16 v = gamma_16_table[*(sp + 1) >> gamma_shift][*sp]; 4169| 0| *sp = (png_byte)((v >> 8) & 0xff); 4170| 0| *(sp + 1) = (png_byte)(v & 0xff); 4171| 0| sp += 2; 4172| | 4173| 0| v = gamma_16_table[*(sp + 1) >> gamma_shift][*sp]; 4174| 0| *sp = (png_byte)((v >> 8) & 0xff); 4175| 0| *(sp + 1) = (png_byte)(v & 0xff); 4176| 0| sp += 2; 4177| | 4178| 0| v = gamma_16_table[*(sp + 1) >> gamma_shift][*sp]; 4179| 0| *sp = (png_byte)((v >> 8) & 0xff); 4180| 0| *(sp + 1) = (png_byte)(v & 0xff); 4181| 0| sp += 4; 4182| 0| } 4183| 0| } 4184| 0| break; 4185| 0| } 4186| | 4187| 0| case PNG_COLOR_TYPE_GRAY_ALPHA: ------------------ | | 670| 0|#define PNG_COLOR_TYPE_GRAY_ALPHA (PNG_COLOR_MASK_ALPHA) | | ------------------ | | | | 663| 0|#define PNG_COLOR_MASK_ALPHA 4 | | ------------------ ------------------ | Branch (4187:10): [True: 0, False: 685] ------------------ 4188| 0| { 4189| 0| if (row_info->bit_depth == 8) ------------------ | Branch (4189:17): [True: 0, False: 0] ------------------ 4190| 0| { 4191| 0| sp = row; 4192| 0| for (i = 0; i < row_width; i++) ------------------ | Branch (4192:28): [True: 0, False: 0] ------------------ 4193| 0| { 4194| 0| *sp = gamma_table[*sp]; 4195| 0| sp += 2; 4196| 0| } 4197| 0| } 4198| | 4199| 0| else /* if (row_info->bit_depth == 16) */ 4200| 0| { 4201| 0| sp = row; 4202| 0| for (i = 0; i < row_width; i++) ------------------ | Branch (4202:28): [True: 0, False: 0] ------------------ 4203| 0| { 4204| 0| png_uint_16 v = gamma_16_table[*(sp + 1) >> gamma_shift][*sp]; 4205| 0| *sp = (png_byte)((v >> 8) & 0xff); 4206| 0| *(sp + 1) = (png_byte)(v & 0xff); 4207| 0| sp += 4; 4208| 0| } 4209| 0| } 4210| 0| break; 4211| 0| } 4212| | 4213| 485| case PNG_COLOR_TYPE_GRAY: ------------------ | | 666| 485|#define PNG_COLOR_TYPE_GRAY 0 ------------------ | Branch (4213:10): [True: 485, False: 200] ------------------ 4214| 485| { 4215| 485| if (row_info->bit_depth == 2) ------------------ | Branch (4215:17): [True: 150, False: 335] ------------------ 4216| 150| { 4217| 150| sp = row; 4218| 592| for (i = 0; i < row_width; i += 4) ------------------ | Branch (4218:28): [True: 442, False: 150] ------------------ 4219| 442| { 4220| 442| int a = *sp & 0xc0; 4221| 442| int b = *sp & 0x30; 4222| 442| int c = *sp & 0x0c; 4223| 442| int d = *sp & 0x03; 4224| | 4225| 442| *sp = (png_byte)( 4226| 442| ((((int)gamma_table[a|(a>>2)|(a>>4)|(a>>6)]) ) & 0xc0)| 4227| 442| ((((int)gamma_table[(b<<2)|b|(b>>2)|(b>>4)])>>2) & 0x30)| 4228| 442| ((((int)gamma_table[(c<<4)|(c<<2)|c|(c>>2)])>>4) & 0x0c)| 4229| 442| ((((int)gamma_table[(d<<6)|(d<<4)|(d<<2)|d])>>6) )); 4230| 442| sp++; 4231| 442| } 4232| 150| } 4233| | 4234| 485| if (row_info->bit_depth == 4) ------------------ | Branch (4234:17): [True: 91, False: 394] ------------------ 4235| 91| { 4236| 91| sp = row; 4237| 467| for (i = 0; i < row_width; i += 2) ------------------ | Branch (4237:28): [True: 376, False: 91] ------------------ 4238| 376| { 4239| 376| int msb = *sp & 0xf0; 4240| 376| int lsb = *sp & 0x0f; 4241| | 4242| 376| *sp = (png_byte)((((int)gamma_table[msb | (msb >> 4)]) & 0xf0) 4243| 376| | (((int)gamma_table[(lsb << 4) | lsb]) >> 4)); 4244| 376| sp++; 4245| 376| } 4246| 91| } 4247| | 4248| 394| else if (row_info->bit_depth == 8) ------------------ | Branch (4248:22): [True: 113, False: 281] ------------------ 4249| 113| { 4250| 113| sp = row; 4251| 595| for (i = 0; i < row_width; i++) ------------------ | Branch (4251:28): [True: 482, False: 113] ------------------ 4252| 482| { 4253| 482| *sp = gamma_table[*sp]; 4254| 482| sp++; 4255| 482| } 4256| 113| } 4257| | 4258| 281| else if (row_info->bit_depth == 16) ------------------ | Branch (4258:22): [True: 131, False: 150] ------------------ 4259| 131| { 4260| 131| sp = row; 4261| 568| for (i = 0; i < row_width; i++) ------------------ | Branch (4261:28): [True: 437, False: 131] ------------------ 4262| 437| { 4263| 437| png_uint_16 v = gamma_16_table[*(sp + 1) >> gamma_shift][*sp]; 4264| 437| *sp = (png_byte)((v >> 8) & 0xff); 4265| 437| *(sp + 1) = (png_byte)(v & 0xff); 4266| 437| sp += 2; 4267| 437| } 4268| 131| } 4269| 485| break; 4270| 0| } 4271| | 4272| 0| default: ------------------ | Branch (4272:10): [True: 0, False: 685] ------------------ 4273| 0| break; 4274| 685| } 4275| 685| } 4276| 685|} pngrtran.c:png_do_scale_16_to_8: 2530| 3.31k|{ 2531| 3.31k| png_debug(1, "in png_do_scale_16_to_8"); ------------------ | | 145| 3.31k|# define png_debug(l, m) ((void)0) ------------------ 2532| | 2533| 3.31k| if (row_info->bit_depth == 16) ------------------ | Branch (2533:8): [True: 3.31k, False: 0] ------------------ 2534| 3.31k| { 2535| 3.31k| png_bytep sp = row; /* source */ 2536| 3.31k| png_bytep dp = row; /* destination */ 2537| 3.31k| png_bytep ep = sp + row_info->rowbytes; /* end+1 */ 2538| | 2539| 367k| while (sp < ep) ------------------ | Branch (2539:14): [True: 363k, False: 3.31k] ------------------ 2540| 363k| { 2541| | /* The input is an array of 16-bit components, these must be scaled to 2542| | * 8 bits each. For a 16-bit value V the required value (from the PNG 2543| | * specification) is: 2544| | * 2545| | * (V * 255) / 65535 2546| | * 2547| | * This reduces to round(V / 257), or floor((V + 128.5)/257) 2548| | * 2549| | * Represent V as the two byte value vhi.vlo. Make a guess that the 2550| | * result is the top byte of V, vhi, then the correction to this value 2551| | * is: 2552| | * 2553| | * error = floor(((V-vhi.vhi) + 128.5) / 257) 2554| | * = floor(((vlo-vhi) + 128.5) / 257) 2555| | * 2556| | * This can be approximated using integer arithmetic (and a signed 2557| | * shift): 2558| | * 2559| | * error = (vlo-vhi+128) >> 8; 2560| | * 2561| | * The approximate differs from the exact answer only when (vlo-vhi) is 2562| | * 128; it then gives a correction of +1 when the exact correction is 2563| | * 0. This gives 128 errors. The exact answer (correct for all 16-bit 2564| | * input values) is: 2565| | * 2566| | * error = (vlo-vhi+128)*65535 >> 24; 2567| | * 2568| | * An alternative arithmetic calculation which also gives no errors is: 2569| | * 2570| | * (V * 255 + 32895) >> 16 2571| | */ 2572| | 2573| 363k| png_int_32 tmp = *sp++; /* must be signed! */ 2574| 363k| tmp += (((int)*sp++ - tmp + 128) * 65535) >> 24; 2575| 363k| *dp++ = (png_byte)tmp; 2576| 363k| } 2577| | 2578| 3.31k| row_info->bit_depth = 8; 2579| 3.31k| row_info->pixel_depth = (png_byte)(8 * row_info->channels); 2580| 3.31k| row_info->rowbytes = (size_t)row_info->width * row_info->channels; 2581| 3.31k| } 2582| 3.31k|} pngrtran.c:png_do_quantize: 4785| 3.79k|{ 4786| 3.79k| png_bytep sp, dp; 4787| 3.79k| png_uint_32 i; 4788| 3.79k| png_uint_32 row_width=row_info->width; 4789| | 4790| 3.79k| png_debug(1, "in png_do_quantize"); ------------------ | | 145| 3.79k|# define png_debug(l, m) ((void)0) ------------------ 4791| | 4792| 3.79k| if (row_info->bit_depth == 8) ------------------ | Branch (4792:8): [True: 3.79k, False: 0] ------------------ 4793| 3.79k| { 4794| 3.79k| if (row_info->color_type == PNG_COLOR_TYPE_RGB && palette_lookup) ------------------ | | 668| 7.58k|#define PNG_COLOR_TYPE_RGB (PNG_COLOR_MASK_COLOR) | | ------------------ | | | | 662| 3.79k|#define PNG_COLOR_MASK_COLOR 2 | | ------------------ ------------------ | Branch (4794:11): [True: 2.26k, False: 1.52k] | Branch (4794:57): [True: 0, False: 2.26k] ------------------ 4795| 0| { 4796| 0| int r, g, b, p; 4797| 0| sp = row; 4798| 0| dp = row; 4799| 0| for (i = 0; i < row_width; i++) ------------------ | Branch (4799:22): [True: 0, False: 0] ------------------ 4800| 0| { 4801| 0| r = *sp++; 4802| 0| g = *sp++; 4803| 0| b = *sp++; 4804| | 4805| | /* This looks real messy, but the compiler will reduce 4806| | * it down to a reasonable formula. For example, with 4807| | * 5 bits per color, we get: 4808| | * p = (((r >> 3) & 0x1f) << 10) | 4809| | * (((g >> 3) & 0x1f) << 5) | 4810| | * ((b >> 3) & 0x1f); 4811| | */ 4812| 0| p = (((r >> (8 - PNG_QUANTIZE_RED_BITS)) & ------------------ | | 219| 0|#define PNG_QUANTIZE_RED_BITS 5 ------------------ 4813| 0| ((1 << PNG_QUANTIZE_RED_BITS) - 1)) << ------------------ | | 219| 0|#define PNG_QUANTIZE_RED_BITS 5 ------------------ 4814| 0| (PNG_QUANTIZE_GREEN_BITS + PNG_QUANTIZE_BLUE_BITS)) | ------------------ | | 218| 0|#define PNG_QUANTIZE_GREEN_BITS 5 ------------------ (PNG_QUANTIZE_GREEN_BITS + PNG_QUANTIZE_BLUE_BITS)) | ------------------ | | 217| 0|#define PNG_QUANTIZE_BLUE_BITS 5 ------------------ 4815| 0| (((g >> (8 - PNG_QUANTIZE_GREEN_BITS)) & ------------------ | | 218| 0|#define PNG_QUANTIZE_GREEN_BITS 5 ------------------ 4816| 0| ((1 << PNG_QUANTIZE_GREEN_BITS) - 1)) << ------------------ | | 218| 0|#define PNG_QUANTIZE_GREEN_BITS 5 ------------------ 4817| 0| (PNG_QUANTIZE_BLUE_BITS)) | ------------------ | | 217| 0|#define PNG_QUANTIZE_BLUE_BITS 5 ------------------ 4818| 0| ((b >> (8 - PNG_QUANTIZE_BLUE_BITS)) & ------------------ | | 217| 0|#define PNG_QUANTIZE_BLUE_BITS 5 ------------------ 4819| 0| ((1 << PNG_QUANTIZE_BLUE_BITS) - 1)); ------------------ | | 217| 0|#define PNG_QUANTIZE_BLUE_BITS 5 ------------------ 4820| | 4821| 0| *dp++ = palette_lookup[p]; 4822| 0| } 4823| | 4824| 0| row_info->color_type = PNG_COLOR_TYPE_PALETTE; ------------------ | | 667| 0|#define PNG_COLOR_TYPE_PALETTE (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_PALETTE) | | ------------------ | | | | 662| 0|#define PNG_COLOR_MASK_COLOR 2 | | ------------------ | | #define PNG_COLOR_TYPE_PALETTE (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_PALETTE) | | ------------------ | | | | 661| 0|#define PNG_COLOR_MASK_PALETTE 1 | | ------------------ ------------------ 4825| 0| row_info->channels = 1; 4826| 0| row_info->pixel_depth = row_info->bit_depth; 4827| 0| row_info->rowbytes = PNG_ROWBYTES(row_info->pixel_depth, row_width); ------------------ | | 755| 0| ((pixel_bits) >= 8 ? \ | | ------------------ | | | Branch (755:6): [True: 0, False: 0] | | ------------------ | | 756| 0| ((size_t)(width) * (((size_t)(pixel_bits)) >> 3)) : \ | | 757| 0| (( ((size_t)(width) * ((size_t)(pixel_bits))) + 7) >> 3) ) ------------------ 4828| 0| } 4829| | 4830| 3.79k| else if (row_info->color_type == PNG_COLOR_TYPE_RGB_ALPHA && ------------------ | | 669| 7.58k|#define PNG_COLOR_TYPE_RGB_ALPHA (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_ALPHA) | | ------------------ | | | | 662| 3.79k|#define PNG_COLOR_MASK_COLOR 2 | | ------------------ | | #define PNG_COLOR_TYPE_RGB_ALPHA (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_ALPHA) | | ------------------ | | | | 663| 3.79k|#define PNG_COLOR_MASK_ALPHA 4 | | ------------------ ------------------ | Branch (4830:16): [True: 1.52k, False: 2.26k] ------------------ 4831| 1.52k| palette_lookup != NULL) ------------------ | Branch (4831:10): [True: 0, False: 1.52k] ------------------ 4832| 0| { 4833| 0| int r, g, b, p; 4834| 0| sp = row; 4835| 0| dp = row; 4836| 0| for (i = 0; i < row_width; i++) ------------------ | Branch (4836:22): [True: 0, False: 0] ------------------ 4837| 0| { 4838| 0| r = *sp++; 4839| 0| g = *sp++; 4840| 0| b = *sp++; 4841| 0| sp++; 4842| | 4843| 0| p = (((r >> (8 - PNG_QUANTIZE_RED_BITS)) & ------------------ | | 219| 0|#define PNG_QUANTIZE_RED_BITS 5 ------------------ 4844| 0| ((1 << PNG_QUANTIZE_RED_BITS) - 1)) << ------------------ | | 219| 0|#define PNG_QUANTIZE_RED_BITS 5 ------------------ 4845| 0| (PNG_QUANTIZE_GREEN_BITS + PNG_QUANTIZE_BLUE_BITS)) | ------------------ | | 218| 0|#define PNG_QUANTIZE_GREEN_BITS 5 ------------------ (PNG_QUANTIZE_GREEN_BITS + PNG_QUANTIZE_BLUE_BITS)) | ------------------ | | 217| 0|#define PNG_QUANTIZE_BLUE_BITS 5 ------------------ 4846| 0| (((g >> (8 - PNG_QUANTIZE_GREEN_BITS)) & ------------------ | | 218| 0|#define PNG_QUANTIZE_GREEN_BITS 5 ------------------ 4847| 0| ((1 << PNG_QUANTIZE_GREEN_BITS) - 1)) << ------------------ | | 218| 0|#define PNG_QUANTIZE_GREEN_BITS 5 ------------------ 4848| 0| (PNG_QUANTIZE_BLUE_BITS)) | ------------------ | | 217| 0|#define PNG_QUANTIZE_BLUE_BITS 5 ------------------ 4849| 0| ((b >> (8 - PNG_QUANTIZE_BLUE_BITS)) & ------------------ | | 217| 0|#define PNG_QUANTIZE_BLUE_BITS 5 ------------------ 4850| 0| ((1 << PNG_QUANTIZE_BLUE_BITS) - 1)); ------------------ | | 217| 0|#define PNG_QUANTIZE_BLUE_BITS 5 ------------------ 4851| | 4852| 0| *dp++ = palette_lookup[p]; 4853| 0| } 4854| | 4855| 0| row_info->color_type = PNG_COLOR_TYPE_PALETTE; ------------------ | | 667| 0|#define PNG_COLOR_TYPE_PALETTE (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_PALETTE) | | ------------------ | | | | 662| 0|#define PNG_COLOR_MASK_COLOR 2 | | ------------------ | | #define PNG_COLOR_TYPE_PALETTE (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_PALETTE) | | ------------------ | | | | 661| 0|#define PNG_COLOR_MASK_PALETTE 1 | | ------------------ ------------------ 4856| 0| row_info->channels = 1; 4857| 0| row_info->pixel_depth = row_info->bit_depth; 4858| 0| row_info->rowbytes = PNG_ROWBYTES(row_info->pixel_depth, row_width); ------------------ | | 755| 0| ((pixel_bits) >= 8 ? \ | | ------------------ | | | Branch (755:6): [True: 0, False: 0] | | ------------------ | | 756| 0| ((size_t)(width) * (((size_t)(pixel_bits)) >> 3)) : \ | | 757| 0| (( ((size_t)(width) * ((size_t)(pixel_bits))) + 7) >> 3) ) ------------------ 4859| 0| } 4860| | 4861| 3.79k| else if (row_info->color_type == PNG_COLOR_TYPE_PALETTE && ------------------ | | 667| 7.58k|#define PNG_COLOR_TYPE_PALETTE (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_PALETTE) | | ------------------ | | | | 662| 3.79k|#define PNG_COLOR_MASK_COLOR 2 | | ------------------ | | #define PNG_COLOR_TYPE_PALETTE (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_PALETTE) | | ------------------ | | | | 661| 3.79k|#define PNG_COLOR_MASK_PALETTE 1 | | ------------------ ------------------ | Branch (4861:16): [True: 0, False: 3.79k] ------------------ 4862| 0| quantize_lookup) ------------------ | Branch (4862:10): [True: 0, False: 0] ------------------ 4863| 0| { 4864| 0| sp = row; 4865| | 4866| 0| for (i = 0; i < row_width; i++, sp++) ------------------ | Branch (4866:22): [True: 0, False: 0] ------------------ 4867| 0| { 4868| 0| *sp = quantize_lookup[*sp]; 4869| 0| } 4870| 0| } 4871| 3.79k| } 4872| 3.79k|} pngrtran.c:png_do_read_invert_alpha: 2712| 2.44k|{ 2713| 2.44k| png_uint_32 row_width; 2714| 2.44k| png_debug(1, "in png_do_read_invert_alpha"); ------------------ | | 145| 2.44k|# define png_debug(l, m) ((void)0) ------------------ 2715| | 2716| 2.44k| row_width = row_info->width; 2717| 2.44k| if (row_info->color_type == PNG_COLOR_TYPE_RGB_ALPHA) ------------------ | | 669| 2.44k|#define PNG_COLOR_TYPE_RGB_ALPHA (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_ALPHA) | | ------------------ | | | | 662| 2.44k|#define PNG_COLOR_MASK_COLOR 2 | | ------------------ | | #define PNG_COLOR_TYPE_RGB_ALPHA (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_ALPHA) | | ------------------ | | | | 663| 2.44k|#define PNG_COLOR_MASK_ALPHA 4 | | ------------------ ------------------ | Branch (2717:8): [True: 1.52k, False: 925] ------------------ 2718| 1.52k| { 2719| 1.52k| if (row_info->bit_depth == 8) ------------------ | Branch (2719:11): [True: 1.52k, False: 0] ------------------ 2720| 1.52k| { 2721| | /* This inverts the alpha channel in RGBA */ 2722| 1.52k| png_bytep sp = row + row_info->rowbytes; 2723| 1.52k| png_bytep dp = sp; 2724| 1.52k| png_uint_32 i; 2725| | 2726| 102k| for (i = 0; i < row_width; i++) ------------------ | Branch (2726:22): [True: 101k, False: 1.52k] ------------------ 2727| 101k| { 2728| 101k| *(--dp) = (png_byte)(255 - *(--sp)); 2729| | 2730| |/* This does nothing: 2731| | *(--dp) = *(--sp); 2732| | *(--dp) = *(--sp); 2733| | *(--dp) = *(--sp); 2734| | We can replace it with: 2735| |*/ 2736| 101k| sp-=3; 2737| 101k| dp=sp; 2738| 101k| } 2739| 1.52k| } 2740| | 2741| 0|#ifdef PNG_READ_16BIT_SUPPORTED 2742| | /* This inverts the alpha channel in RRGGBBAA */ 2743| 0| else 2744| 0| { 2745| 0| png_bytep sp = row + row_info->rowbytes; 2746| 0| png_bytep dp = sp; 2747| 0| png_uint_32 i; 2748| | 2749| 0| for (i = 0; i < row_width; i++) ------------------ | Branch (2749:22): [True: 0, False: 0] ------------------ 2750| 0| { 2751| 0| *(--dp) = (png_byte)(255 - *(--sp)); 2752| 0| *(--dp) = (png_byte)(255 - *(--sp)); 2753| | 2754| |/* This does nothing: 2755| | *(--dp) = *(--sp); 2756| | *(--dp) = *(--sp); 2757| | *(--dp) = *(--sp); 2758| | *(--dp) = *(--sp); 2759| | *(--dp) = *(--sp); 2760| | *(--dp) = *(--sp); 2761| | We can replace it with: 2762| |*/ 2763| 0| sp-=6; 2764| 0| dp=sp; 2765| 0| } 2766| 0| } 2767| 1.52k|#endif 2768| 1.52k| } 2769| 925| else if (row_info->color_type == PNG_COLOR_TYPE_GRAY_ALPHA) ------------------ | | 670| 925|#define PNG_COLOR_TYPE_GRAY_ALPHA (PNG_COLOR_MASK_ALPHA) | | ------------------ | | | | 663| 925|#define PNG_COLOR_MASK_ALPHA 4 | | ------------------ ------------------ | Branch (2769:13): [True: 925, False: 0] ------------------ 2770| 925| { 2771| 925| if (row_info->bit_depth == 8) ------------------ | Branch (2771:11): [True: 925, False: 0] ------------------ 2772| 925| { 2773| | /* This inverts the alpha channel in GA */ 2774| 925| png_bytep sp = row + row_info->rowbytes; 2775| 925| png_bytep dp = sp; 2776| 925| png_uint_32 i; 2777| | 2778| 32.3k| for (i = 0; i < row_width; i++) ------------------ | Branch (2778:22): [True: 31.3k, False: 925] ------------------ 2779| 31.3k| { 2780| 31.3k| *(--dp) = (png_byte)(255 - *(--sp)); 2781| 31.3k| *(--dp) = *(--sp); 2782| 31.3k| } 2783| 925| } 2784| | 2785| 0|#ifdef PNG_READ_16BIT_SUPPORTED 2786| 0| else 2787| 0| { 2788| | /* This inverts the alpha channel in GGAA */ 2789| 0| png_bytep sp = row + row_info->rowbytes; 2790| 0| png_bytep dp = sp; 2791| 0| png_uint_32 i; 2792| | 2793| 0| for (i = 0; i < row_width; i++) ------------------ | Branch (2793:22): [True: 0, False: 0] ------------------ 2794| 0| { 2795| 0| *(--dp) = (png_byte)(255 - *(--sp)); 2796| 0| *(--dp) = (png_byte)(255 - *(--sp)); 2797| |/* 2798| | *(--dp) = *(--sp); 2799| | *(--dp) = *(--sp); 2800| |*/ 2801| 0| sp-=2; 2802| 0| dp=sp; 2803| 0| } 2804| 0| } 2805| 925|#endif 2806| 925| } 2807| 2.44k|} pngrtran.c:png_do_unpack: 2293| 3.11k|{ 2294| 3.11k| png_debug(1, "in png_do_unpack"); ------------------ | | 145| 3.11k|# define png_debug(l, m) ((void)0) ------------------ 2295| | 2296| 3.11k| if (row_info->bit_depth < 8) ------------------ | Branch (2296:8): [True: 3.11k, False: 0] ------------------ 2297| 3.11k| { 2298| 3.11k| png_uint_32 i; 2299| 3.11k| png_uint_32 row_width=row_info->width; 2300| | 2301| 3.11k| switch (row_info->bit_depth) 2302| 3.11k| { 2303| 880| case 1: ------------------ | Branch (2303:10): [True: 880, False: 2.23k] ------------------ 2304| 880| { 2305| 880| png_bytep sp = row + (size_t)((row_width - 1) >> 3); 2306| 880| png_bytep dp = row + (size_t)row_width - 1; 2307| 880| png_uint_32 shift = 7U - ((row_width + 7U) & 0x07); 2308| 17.7k| for (i = 0; i < row_width; i++) ------------------ | Branch (2308:25): [True: 16.8k, False: 880] ------------------ 2309| 16.8k| { 2310| 16.8k| *dp = (png_byte)((*sp >> shift) & 0x01); 2311| | 2312| 16.8k| if (shift == 7) ------------------ | Branch (2312:20): [True: 2.27k, False: 14.6k] ------------------ 2313| 2.27k| { 2314| 2.27k| shift = 0; 2315| 2.27k| sp--; 2316| 2.27k| } 2317| | 2318| 14.6k| else 2319| 14.6k| shift++; 2320| | 2321| 16.8k| dp--; 2322| 16.8k| } 2323| 880| break; 2324| 0| } 2325| | 2326| 1.36k| case 2: ------------------ | Branch (2326:10): [True: 1.36k, False: 1.74k] ------------------ 2327| 1.36k| { 2328| | 2329| 1.36k| png_bytep sp = row + (size_t)((row_width - 1) >> 2); 2330| 1.36k| png_bytep dp = row + (size_t)row_width - 1; 2331| 1.36k| png_uint_32 shift = ((3U - ((row_width + 3U) & 0x03)) << 1); 2332| 22.4k| for (i = 0; i < row_width; i++) ------------------ | Branch (2332:25): [True: 21.0k, False: 1.36k] ------------------ 2333| 21.0k| { 2334| 21.0k| *dp = (png_byte)((*sp >> shift) & 0x03); 2335| | 2336| 21.0k| if (shift == 6) ------------------ | Branch (2336:20): [True: 5.53k, False: 15.5k] ------------------ 2337| 5.53k| { 2338| 5.53k| shift = 0; 2339| 5.53k| sp--; 2340| 5.53k| } 2341| | 2342| 15.5k| else 2343| 15.5k| shift += 2; 2344| | 2345| 21.0k| dp--; 2346| 21.0k| } 2347| 1.36k| break; 2348| 0| } 2349| | 2350| 867| case 4: ------------------ | Branch (2350:10): [True: 867, False: 2.24k] ------------------ 2351| 867| { 2352| 867| png_bytep sp = row + (size_t)((row_width - 1) >> 1); 2353| 867| png_bytep dp = row + (size_t)row_width - 1; 2354| 867| png_uint_32 shift = ((1U - ((row_width + 1U) & 0x01)) << 2); 2355| 10.7k| for (i = 0; i < row_width; i++) ------------------ | Branch (2355:25): [True: 9.91k, False: 867] ------------------ 2356| 9.91k| { 2357| 9.91k| *dp = (png_byte)((*sp >> shift) & 0x0f); 2358| | 2359| 9.91k| if (shift == 4) ------------------ | Branch (2359:20): [True: 4.98k, False: 4.92k] ------------------ 2360| 4.98k| { 2361| 4.98k| shift = 0; 2362| 4.98k| sp--; 2363| 4.98k| } 2364| | 2365| 4.92k| else 2366| 4.92k| shift = 4; 2367| | 2368| 9.91k| dp--; 2369| 9.91k| } 2370| 867| break; 2371| 0| } 2372| | 2373| 0| default: ------------------ | Branch (2373:10): [True: 0, False: 3.11k] ------------------ 2374| 0| break; 2375| 3.11k| } 2376| 3.11k| row_info->bit_depth = 8; 2377| 3.11k| row_info->pixel_depth = (png_byte)(8 * row_info->channels); 2378| 3.11k| row_info->rowbytes = (size_t)row_width * row_info->channels; 2379| 3.11k| } 2380| 3.11k|} pngrtran.c:png_do_read_swap_alpha: 2616| 2.44k|{ 2617| 2.44k| png_uint_32 row_width = row_info->width; 2618| | 2619| 2.44k| png_debug(1, "in png_do_read_swap_alpha"); ------------------ | | 145| 2.44k|# define png_debug(l, m) ((void)0) ------------------ 2620| | 2621| 2.44k| if (row_info->color_type == PNG_COLOR_TYPE_RGB_ALPHA) ------------------ | | 669| 2.44k|#define PNG_COLOR_TYPE_RGB_ALPHA (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_ALPHA) | | ------------------ | | | | 662| 2.44k|#define PNG_COLOR_MASK_COLOR 2 | | ------------------ | | #define PNG_COLOR_TYPE_RGB_ALPHA (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_ALPHA) | | ------------------ | | | | 663| 2.44k|#define PNG_COLOR_MASK_ALPHA 4 | | ------------------ ------------------ | Branch (2621:8): [True: 1.52k, False: 925] ------------------ 2622| 1.52k| { 2623| | /* This converts from RGBA to ARGB */ 2624| 1.52k| if (row_info->bit_depth == 8) ------------------ | Branch (2624:11): [True: 1.52k, False: 0] ------------------ 2625| 1.52k| { 2626| 1.52k| png_bytep sp = row + row_info->rowbytes; 2627| 1.52k| png_bytep dp = sp; 2628| 1.52k| png_byte save; 2629| 1.52k| png_uint_32 i; 2630| | 2631| 102k| for (i = 0; i < row_width; i++) ------------------ | Branch (2631:22): [True: 101k, False: 1.52k] ------------------ 2632| 101k| { 2633| 101k| save = *(--sp); 2634| 101k| *(--dp) = *(--sp); 2635| 101k| *(--dp) = *(--sp); 2636| 101k| *(--dp) = *(--sp); 2637| 101k| *(--dp) = save; 2638| 101k| } 2639| 1.52k| } 2640| | 2641| 0|#ifdef PNG_READ_16BIT_SUPPORTED 2642| | /* This converts from RRGGBBAA to AARRGGBB */ 2643| 0| else 2644| 0| { 2645| 0| png_bytep sp = row + row_info->rowbytes; 2646| 0| png_bytep dp = sp; 2647| 0| png_byte save[2]; 2648| 0| png_uint_32 i; 2649| | 2650| 0| for (i = 0; i < row_width; i++) ------------------ | Branch (2650:22): [True: 0, False: 0] ------------------ 2651| 0| { 2652| 0| save[0] = *(--sp); 2653| 0| save[1] = *(--sp); 2654| 0| *(--dp) = *(--sp); 2655| 0| *(--dp) = *(--sp); 2656| 0| *(--dp) = *(--sp); 2657| 0| *(--dp) = *(--sp); 2658| 0| *(--dp) = *(--sp); 2659| 0| *(--dp) = *(--sp); 2660| 0| *(--dp) = save[0]; 2661| 0| *(--dp) = save[1]; 2662| 0| } 2663| 0| } 2664| 1.52k|#endif 2665| 1.52k| } 2666| | 2667| 925| else if (row_info->color_type == PNG_COLOR_TYPE_GRAY_ALPHA) ------------------ | | 670| 925|#define PNG_COLOR_TYPE_GRAY_ALPHA (PNG_COLOR_MASK_ALPHA) | | ------------------ | | | | 663| 925|#define PNG_COLOR_MASK_ALPHA 4 | | ------------------ ------------------ | Branch (2667:13): [True: 925, False: 0] ------------------ 2668| 925| { 2669| | /* This converts from GA to AG */ 2670| 925| if (row_info->bit_depth == 8) ------------------ | Branch (2670:11): [True: 925, False: 0] ------------------ 2671| 925| { 2672| 925| png_bytep sp = row + row_info->rowbytes; 2673| 925| png_bytep dp = sp; 2674| 925| png_byte save; 2675| 925| png_uint_32 i; 2676| | 2677| 32.3k| for (i = 0; i < row_width; i++) ------------------ | Branch (2677:22): [True: 31.3k, False: 925] ------------------ 2678| 31.3k| { 2679| 31.3k| save = *(--sp); 2680| 31.3k| *(--dp) = *(--sp); 2681| 31.3k| *(--dp) = save; 2682| 31.3k| } 2683| 925| } 2684| | 2685| 0|#ifdef PNG_READ_16BIT_SUPPORTED 2686| | /* This converts from GGAA to AAGG */ 2687| 0| else 2688| 0| { 2689| 0| png_bytep sp = row + row_info->rowbytes; 2690| 0| png_bytep dp = sp; 2691| 0| png_byte save[2]; 2692| 0| png_uint_32 i; 2693| | 2694| 0| for (i = 0; i < row_width; i++) ------------------ | Branch (2694:22): [True: 0, False: 0] ------------------ 2695| 0| { 2696| 0| save[0] = *(--sp); 2697| 0| save[1] = *(--sp); 2698| 0| *(--dp) = *(--sp); 2699| 0| *(--dp) = *(--sp); 2700| 0| *(--dp) = save[0]; 2701| 0| *(--dp) = save[1]; 2702| 0| } 2703| 0| } 2704| 925|#endif 2705| 925| } 2706| 2.44k|} OSS_FUZZ_png_get_uint_31: 42| 108k|{ 43| 108k| png_uint_32 uval = png_get_uint_32(buf); ------------------ | | 322| 108k|#define png_get_uint_32 OSS_FUZZ_png_get_uint_32 | | ------------------ | | | | 462| 108k|#define OSS_FUZZ_png_get_uint_32(buf) PNG_get_uint_32(buf) | | | | ------------------ | | | | | | 2823| 108k| (((png_uint_32)(*(buf)) << 24) + \ | | | | | | 2824| 108k| ((png_uint_32)(*((buf) + 1)) << 16) + \ | | | | | | 2825| 108k| ((png_uint_32)(*((buf) + 2)) << 8) + \ | | | | | | 2826| 108k| ((png_uint_32)(*((buf) + 3)))) | | | | ------------------ | | ------------------ ------------------ 44| | 45| 108k| if (uval > PNG_UINT_31_MAX) ------------------ | | 647| 108k|#define PNG_UINT_31_MAX ((png_uint_32)0x7fffffffL) ------------------ | Branch (45:8): [True: 43, False: 108k] ------------------ 46| 43| png_error(png_ptr, "PNG unsigned integer out of range"); ------------------ | | 252| 43|#define png_error OSS_FUZZ_png_error ------------------ 47| | 48| 108k| return uval; 49| 108k|} OSS_FUZZ_png_read_sig: 117| 6.52k|{ 118| 6.52k| size_t num_checked, num_to_check; 119| | 120| | /* Exit if the user application does not expect a signature. */ 121| 6.52k| if (png_ptr->sig_bytes >= 8) ------------------ | Branch (121:8): [True: 0, False: 6.52k] ------------------ 122| 0| return; 123| | 124| 6.52k| num_checked = png_ptr->sig_bytes; 125| 6.52k| num_to_check = 8 - num_checked; 126| | 127| 6.52k|#ifdef PNG_IO_STATE_SUPPORTED 128| 6.52k| png_ptr->io_state = PNG_IO_READING | PNG_IO_SIGNATURE; ------------------ | | 2664| 6.52k|# define PNG_IO_READING 0x0001 /* currently reading */ ------------------ png_ptr->io_state = PNG_IO_READING | PNG_IO_SIGNATURE; ------------------ | | 2666| 6.52k|# define PNG_IO_SIGNATURE 0x0010 /* currently at the file signature */ ------------------ 129| 6.52k|#endif 130| | 131| | /* The signature must be serialized in a single I/O call. */ 132| 6.52k| png_read_data(png_ptr, &(info_ptr->signature[num_checked]), num_to_check); ------------------ | | 23| 6.52k|#define png_read_data OSS_FUZZ_png_read_data ------------------ 133| 6.52k| png_ptr->sig_bytes = 8; 134| | 135| 6.52k| if (png_sig_cmp(info_ptr->signature, num_checked, num_to_check) != 0) ------------------ | | 448| 6.52k|#define png_sig_cmp OSS_FUZZ_png_sig_cmp ------------------ | Branch (135:8): [True: 68, False: 6.46k] ------------------ 136| 68| { 137| 68| if (num_checked < 4 && ------------------ | Branch (137:11): [True: 68, False: 0] ------------------ 138| 68| png_sig_cmp(info_ptr->signature, num_checked, num_to_check - 4) != 0) ------------------ | | 448| 68|#define png_sig_cmp OSS_FUZZ_png_sig_cmp ------------------ | Branch (138:11): [True: 35, False: 33] ------------------ 139| 35| png_error(png_ptr, "Not a PNG file"); ------------------ | | 252| 35|#define png_error OSS_FUZZ_png_error ------------------ 140| 33| else 141| 33| png_error(png_ptr, "PNG file corrupted by ASCII conversion"); ------------------ | | 252| 33|#define png_error OSS_FUZZ_png_error ------------------ 142| 68| } 143| 6.46k| if (num_checked < 3) ------------------ | Branch (143:8): [True: 6.46k, False: 0] ------------------ 144| 6.46k| png_ptr->mode |= PNG_HAVE_PNG_SIGNATURE; ------------------ | | 652| 6.46k|#define PNG_HAVE_PNG_SIGNATURE 0x1000U ------------------ 145| 6.46k|} OSS_FUZZ_png_read_chunk_header: 184| 99.2k|{ 185| 99.2k| png_byte buf[8]; 186| 99.2k| png_uint_32 chunk_name, length; 187| | 188| 99.2k|#ifdef PNG_IO_STATE_SUPPORTED 189| 99.2k| png_ptr->io_state = PNG_IO_READING | PNG_IO_CHUNK_HDR; ------------------ | | 2664| 99.2k|# define PNG_IO_READING 0x0001 /* currently reading */ ------------------ png_ptr->io_state = PNG_IO_READING | PNG_IO_CHUNK_HDR; ------------------ | | 2667| 99.2k|# define PNG_IO_CHUNK_HDR 0x0020 /* currently at the chunk header */ ------------------ 190| 99.2k|#endif 191| | 192| | /* Read the length and the chunk name. png_struct::chunk_name is immediately 193| | * updated even if they are detectably wrong. This aids error message 194| | * handling by allowing png_chunk_error to be used. 195| | */ 196| 99.2k| png_read_data(png_ptr, buf, 8); ------------------ | | 23| 99.2k|#define png_read_data OSS_FUZZ_png_read_data ------------------ 197| 99.2k| length = png_get_uint_31(png_ptr, buf); ------------------ | | 321| 99.2k|#define png_get_uint_31 OSS_FUZZ_png_get_uint_31 ------------------ 198| 99.2k| png_ptr->chunk_name = chunk_name = PNG_CHUNK_FROM_STRING(buf+4); ------------------ | | 924| 99.2k| PNG_U32(0xff & (s)[0], 0xff & (s)[1], 0xff & (s)[2], 0xff & (s)[3]) | | ------------------ | | | | 845| 99.2k| (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0)) | | | | ------------------ | | | | | | 843| 99.2k|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s)) | | | | ------------------ | | | | (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0)) | | | | ------------------ | | | | | | 843| 99.2k|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s)) | | | | ------------------ | | | | (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0)) | | | | ------------------ | | | | | | 843| 99.2k|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s)) | | | | ------------------ | | | | (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0)) | | | | ------------------ | | | | | | 843| 99.2k|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s)) | | | | ------------------ | | ------------------ ------------------ 199| | 200| | /* Reset the crc and run it over the chunk name. */ 201| 99.2k| png_reset_crc(png_ptr); ------------------ | | 19| 99.2k|#define png_reset_crc OSS_FUZZ_png_reset_crc ------------------ 202| 99.2k| png_calculate_crc(png_ptr, buf + 4, 4); ------------------ | | 26| 99.2k|#define png_calculate_crc OSS_FUZZ_png_calculate_crc ------------------ 203| | 204| 99.2k| png_debug2(0, "Reading chunk typeid = 0x%lx, length = %lu", ------------------ | | 151| 99.2k|# define png_debug2(l, m, p1, p2) ((void)0) ------------------ 205| 99.2k| (unsigned long)png_ptr->chunk_name, (unsigned long)length); 206| | 207| | /* Sanity check the length (first by <= 0x80) and the chunk name. An error 208| | * here indicates a broken stream and libpng has no recovery from this. 209| | */ 210| 99.2k| if (buf[0] >= 0x80U) ------------------ | Branch (210:8): [True: 0, False: 99.2k] ------------------ 211| 0| png_chunk_error(png_ptr, "bad header (invalid length)"); ------------------ | | 239| 0|#define png_chunk_error OSS_FUZZ_png_chunk_error ------------------ 212| | 213| | /* Check to see if chunk name is valid. */ 214| 99.2k| if (!check_chunk_name(chunk_name)) ------------------ | Branch (214:8): [True: 168, False: 99.0k] ------------------ 215| 168| png_chunk_error(png_ptr, "bad header (invalid type)"); ------------------ | | 239| 168|#define png_chunk_error OSS_FUZZ_png_chunk_error ------------------ 216| | 217| 99.0k|#ifdef PNG_IO_STATE_SUPPORTED 218| 99.0k| png_ptr->io_state = PNG_IO_READING | PNG_IO_CHUNK_DATA; ------------------ | | 2664| 99.0k|# define PNG_IO_READING 0x0001 /* currently reading */ ------------------ png_ptr->io_state = PNG_IO_READING | PNG_IO_CHUNK_DATA; ------------------ | | 2668| 99.0k|# define PNG_IO_CHUNK_DATA 0x0040 /* currently at the chunk data */ ------------------ 219| 99.0k|#endif 220| | 221| 99.0k| return length; 222| 99.2k|} OSS_FUZZ_png_crc_read: 227| 104k|{ 228| 104k| if (png_ptr == NULL) ------------------ | Branch (228:8): [True: 0, False: 104k] ------------------ 229| 0| return; 230| | 231| 104k| png_read_data(png_ptr, buf, length); ------------------ | | 23| 104k|#define png_read_data OSS_FUZZ_png_read_data ------------------ 232| 104k| png_calculate_crc(png_ptr, buf, length); ------------------ | | 26| 104k|#define png_calculate_crc OSS_FUZZ_png_calculate_crc ------------------ 233| 104k|} OSS_FUZZ_png_crc_finish: 361| 95.1k|{ 362| 95.1k| return png_crc_finish_critical(png_ptr, skip, 0/*critical handling*/); 363| 95.1k|} OSS_FUZZ_png_zlib_inflate: 526| 130k|{ 527| 130k| if (png_ptr->zstream_start && png_ptr->zstream.avail_in > 0) ------------------ | Branch (527:8): [True: 10.2k, False: 120k] | Branch (527:34): [True: 10.2k, False: 0] ------------------ 528| 10.2k| { 529| 10.2k| if ((*png_ptr->zstream.next_in >> 4) > 7) ------------------ | Branch (529:11): [True: 352, False: 9.93k] ------------------ 530| 352| { 531| 352| png_ptr->zstream.msg = "invalid window size (libpng)"; 532| 352| return Z_DATA_ERROR; 533| 352| } 534| | 535| 9.93k| png_ptr->zstream_start = 0; 536| 9.93k| } 537| | 538| 130k| return inflate(&png_ptr->zstream, flush); 539| 130k|} OSS_FUZZ_png_handle_unknown: 2763| 4.33k|{ 2764| 4.33k| png_handle_result_code handled = handled_discarded; /* the default */ 2765| | 2766| 4.33k| png_debug(1, "in png_handle_unknown"); ------------------ | | 145| 4.33k|# define png_debug(l, m) ((void)0) ------------------ 2767| | 2768| 4.33k|#ifdef PNG_READ_UNKNOWN_CHUNKS_SUPPORTED 2769| | /* NOTE: this code is based on the code in libpng-1.4.12 except for fixing 2770| | * the bug which meant that setting a non-default behavior for a specific 2771| | * chunk would be ignored (the default was always used unless a user 2772| | * callback was installed). 2773| | * 2774| | * 'keep' is the value from the png_chunk_unknown_handling, the setting for 2775| | * this specific chunk_name, if PNG_HANDLE_AS_UNKNOWN_SUPPORTED, if not it 2776| | * will always be PNG_HANDLE_CHUNK_AS_DEFAULT and it needs to be set here. 2777| | * This is just an optimization to avoid multiple calls to the lookup 2778| | * function. 2779| | */ 2780| |# ifndef PNG_HANDLE_AS_UNKNOWN_SUPPORTED 2781| |# ifdef PNG_SET_UNKNOWN_CHUNKS_SUPPORTED 2782| | keep = png_chunk_unknown_handling(png_ptr, png_ptr->chunk_name); 2783| |# endif 2784| |# endif 2785| | 2786| | /* One of the following methods will read the chunk or skip it (at least one 2787| | * of these is always defined because this is the only way to switch on 2788| | * PNG_READ_UNKNOWN_CHUNKS_SUPPORTED) 2789| | */ 2790| 4.33k|# ifdef PNG_READ_USER_CHUNKS_SUPPORTED 2791| | /* The user callback takes precedence over the chunk keep value, but the 2792| | * keep value is still required to validate a save of a critical chunk. 2793| | */ 2794| 4.33k| if (png_ptr->read_user_chunk_fn != NULL) ------------------ | Branch (2794:8): [True: 0, False: 4.33k] ------------------ 2795| 0| { 2796| 0| if (png_cache_unknown_chunk(png_ptr, length) != 0) ------------------ | Branch (2796:11): [True: 0, False: 0] ------------------ 2797| 0| { 2798| | /* Callback to user unknown chunk handler */ 2799| 0| int ret = (*(png_ptr->read_user_chunk_fn))(png_ptr, 2800| 0| &png_ptr->unknown_chunk); 2801| | 2802| | /* ret is: 2803| | * negative: An error occurred; png_chunk_error will be called. 2804| | * zero: The chunk was not handled, the chunk will be discarded 2805| | * unless png_set_keep_unknown_chunks has been used to set 2806| | * a 'keep' behavior for this particular chunk, in which 2807| | * case that will be used. A critical chunk will cause an 2808| | * error at this point unless it is to be saved. 2809| | * positive: The chunk was handled, libpng will ignore/discard it. 2810| | */ 2811| 0| if (ret < 0) /* handled_error */ ------------------ | Branch (2811:14): [True: 0, False: 0] ------------------ 2812| 0| png_chunk_error(png_ptr, "error in user chunk"); ------------------ | | 239| 0|#define png_chunk_error OSS_FUZZ_png_chunk_error ------------------ 2813| | 2814| 0| else if (ret == 0) ------------------ | Branch (2814:19): [True: 0, False: 0] ------------------ 2815| 0| { 2816| | /* If the keep value is 'default' or 'never' override it, but 2817| | * still error out on critical chunks unless the keep value is 2818| | * 'always' While this is weird it is the behavior in 1.4.12. 2819| | * A possible improvement would be to obey the value set for the 2820| | * chunk, but this would be an API change that would probably 2821| | * damage some applications. 2822| | * 2823| | * The png_app_warning below catches the case that matters, where 2824| | * the application has not set specific save or ignore for this 2825| | * chunk or global save or ignore. 2826| | */ 2827| 0| if (keep < PNG_HANDLE_CHUNK_IF_SAFE) ------------------ | | 2585| 0|#define PNG_HANDLE_CHUNK_IF_SAFE 2 ------------------ | Branch (2827:17): [True: 0, False: 0] ------------------ 2828| 0| { 2829| 0|# ifdef PNG_SET_UNKNOWN_CHUNKS_SUPPORTED 2830| 0| if (png_ptr->unknown_default < PNG_HANDLE_CHUNK_IF_SAFE) ------------------ | | 2585| 0|#define PNG_HANDLE_CHUNK_IF_SAFE 2 ------------------ | Branch (2830:20): [True: 0, False: 0] ------------------ 2831| 0| { 2832| 0| png_chunk_warning(png_ptr, "Saving unknown chunk:"); ------------------ | | 240| 0|#define png_chunk_warning OSS_FUZZ_png_chunk_warning ------------------ 2833| 0| png_app_warning(png_ptr, ------------------ | | 81| 0|#define png_app_warning OSS_FUZZ_png_app_warning ------------------ 2834| 0| "forcing save of an unhandled chunk;" 2835| 0| " please call png_set_keep_unknown_chunks"); 2836| | /* with keep = PNG_HANDLE_CHUNK_IF_SAFE */ 2837| 0| } 2838| 0|# endif 2839| 0| keep = PNG_HANDLE_CHUNK_IF_SAFE; ------------------ | | 2585| 0|#define PNG_HANDLE_CHUNK_IF_SAFE 2 ------------------ 2840| 0| } 2841| 0| } 2842| | 2843| 0| else /* chunk was handled */ 2844| 0| { 2845| 0| handled = handled_ok; 2846| | /* Critical chunks can be safely discarded at this point. */ 2847| 0| keep = PNG_HANDLE_CHUNK_NEVER; ------------------ | | 2584| 0|#define PNG_HANDLE_CHUNK_NEVER 1 ------------------ 2848| 0| } 2849| 0| } 2850| | 2851| 0| else 2852| 0| keep = PNG_HANDLE_CHUNK_NEVER; /* insufficient memory */ ------------------ | | 2584| 0|#define PNG_HANDLE_CHUNK_NEVER 1 ------------------ 2853| 0| } 2854| | 2855| 4.33k| else 2856| | /* Use the SAVE_UNKNOWN_CHUNKS code or skip the chunk */ 2857| 4.33k|# endif /* READ_USER_CHUNKS */ 2858| | 2859| 4.33k|# ifdef PNG_SAVE_UNKNOWN_CHUNKS_SUPPORTED 2860| 4.33k| { 2861| | /* keep is currently just the per-chunk setting, if there was no 2862| | * setting change it to the global default now (not that this may 2863| | * still be AS_DEFAULT) then obtain the cache of the chunk if required, 2864| | * if not simply skip the chunk. 2865| | */ 2866| 4.33k| if (keep == PNG_HANDLE_CHUNK_AS_DEFAULT) ------------------ | | 2583| 4.33k|#define PNG_HANDLE_CHUNK_AS_DEFAULT 0 ------------------ | Branch (2866:11): [True: 4.33k, False: 0] ------------------ 2867| 4.33k| keep = png_ptr->unknown_default; 2868| | 2869| 4.33k| if (keep == PNG_HANDLE_CHUNK_ALWAYS || ------------------ | | 2586| 8.66k|#define PNG_HANDLE_CHUNK_ALWAYS 3 ------------------ | Branch (2869:11): [True: 0, False: 4.33k] ------------------ 2870| 4.33k| (keep == PNG_HANDLE_CHUNK_IF_SAFE && ------------------ | | 2585| 8.66k|#define PNG_HANDLE_CHUNK_IF_SAFE 2 ------------------ | Branch (2870:11): [True: 0, False: 4.33k] ------------------ 2871| 0| PNG_CHUNK_ANCILLARY(png_ptr->chunk_name))) ------------------ | | 941| 0|#define PNG_CHUNK_ANCILLARY(c) (1 & ((c) >> 29)) | | ------------------ | | | Branch (941:34): [True: 0, False: 0] | | ------------------ ------------------ 2872| 0| { 2873| 0| if (png_cache_unknown_chunk(png_ptr, length) == 0) ------------------ | Branch (2873:14): [True: 0, False: 0] ------------------ 2874| 0| keep = PNG_HANDLE_CHUNK_NEVER; ------------------ | | 2584| 0|#define PNG_HANDLE_CHUNK_NEVER 1 ------------------ 2875| 0| } 2876| | 2877| 4.33k| else 2878| 4.33k| png_crc_finish(png_ptr, length); ------------------ | | 25| 4.33k|#define png_crc_finish OSS_FUZZ_png_crc_finish ------------------ 2879| 4.33k| } 2880| |# else 2881| |# ifndef PNG_READ_USER_CHUNKS_SUPPORTED 2882| |# error no method to support READ_UNKNOWN_CHUNKS 2883| |# endif 2884| | 2885| | { 2886| | /* If here there is no read callback pointer set and no support is 2887| | * compiled in to just save the unknown chunks, so simply skip this 2888| | * chunk. If 'keep' is something other than AS_DEFAULT or NEVER then 2889| | * the app has erroneously asked for unknown chunk saving when there 2890| | * is no support. 2891| | */ 2892| | if (keep > PNG_HANDLE_CHUNK_NEVER) 2893| | png_app_error(png_ptr, "no unknown chunk support available"); 2894| | 2895| | png_crc_finish(png_ptr, length); 2896| | } 2897| |# endif 2898| | 2899| 4.33k|# ifdef PNG_STORE_UNKNOWN_CHUNKS_SUPPORTED 2900| | /* Now store the chunk in the chunk list if appropriate, and if the limits 2901| | * permit it. 2902| | */ 2903| 4.33k| if (keep == PNG_HANDLE_CHUNK_ALWAYS || ------------------ | | 2586| 8.66k|#define PNG_HANDLE_CHUNK_ALWAYS 3 ------------------ | Branch (2903:8): [True: 996, False: 3.33k] ------------------ 2904| 3.33k| (keep == PNG_HANDLE_CHUNK_IF_SAFE && ------------------ | | 2585| 6.67k|#define PNG_HANDLE_CHUNK_IF_SAFE 2 ------------------ | Branch (2904:8): [True: 0, False: 3.33k] ------------------ 2905| 0| PNG_CHUNK_ANCILLARY(png_ptr->chunk_name))) ------------------ | | 941| 0|#define PNG_CHUNK_ANCILLARY(c) (1 & ((c) >> 29)) | | ------------------ | | | Branch (941:34): [True: 0, False: 0] | | ------------------ ------------------ 2906| 0| { 2907| 0|# ifdef PNG_USER_LIMITS_SUPPORTED 2908| 0| switch (png_ptr->user_chunk_cache_max) 2909| 0| { 2910| 0| case 2: ------------------ | Branch (2910:10): [True: 0, False: 0] ------------------ 2911| 0| png_ptr->user_chunk_cache_max = 1; 2912| 0| png_chunk_benign_error(png_ptr, "no space in chunk cache"); ------------------ | | 238| 0|#define png_chunk_benign_error OSS_FUZZ_png_chunk_benign_error ------------------ 2913| | /* FALLTHROUGH */ 2914| 0| case 1: ------------------ | Branch (2914:10): [True: 0, False: 0] ------------------ 2915| | /* NOTE: prior to 1.6.0 this case resulted in an unknown critical 2916| | * chunk being skipped, now there will be a hard error below. 2917| | */ 2918| 0| break; 2919| | 2920| 0| default: /* not at limit */ ------------------ | Branch (2920:10): [True: 0, False: 0] ------------------ 2921| 0| --(png_ptr->user_chunk_cache_max); 2922| | /* FALLTHROUGH */ 2923| 0| case 0: /* no limit */ ------------------ | Branch (2923:10): [True: 0, False: 0] ------------------ 2924| 0|# endif /* USER_LIMITS */ 2925| | /* Here when the limit isn't reached or when limits are compiled 2926| | * out; store the chunk. 2927| | */ 2928| 0| png_set_unknown_chunks(png_ptr, info_ptr, ------------------ | | 443| 0|#define png_set_unknown_chunks OSS_FUZZ_png_set_unknown_chunks ------------------ 2929| 0| &png_ptr->unknown_chunk, 1); 2930| 0| handled = handled_saved; 2931| 0|# ifdef PNG_USER_LIMITS_SUPPORTED 2932| 0| break; 2933| 0| } 2934| 0|# endif 2935| 0| } 2936| |# else /* no store support: the chunk must be handled by the user callback */ 2937| | PNG_UNUSED(info_ptr) 2938| |# endif 2939| | 2940| | /* Regardless of the error handling below the cached data (if any) can be 2941| | * freed now. Notice that the data is not freed if there is a png_error, but 2942| | * it will be freed by destroy_read_struct. 2943| | */ 2944| 4.33k| if (png_ptr->unknown_chunk.data != NULL) ------------------ | Branch (2944:8): [True: 0, False: 4.33k] ------------------ 2945| 0| png_free(png_ptr, png_ptr->unknown_chunk.data); ------------------ | | 253| 0|#define png_free OSS_FUZZ_png_free ------------------ 2946| 4.33k| png_ptr->unknown_chunk.data = NULL; 2947| | 2948| |#else /* !PNG_READ_UNKNOWN_CHUNKS_SUPPORTED */ 2949| | /* There is no support to read an unknown chunk, so just skip it. */ 2950| | png_crc_finish(png_ptr, length); 2951| | PNG_UNUSED(info_ptr) 2952| | PNG_UNUSED(keep) 2953| |#endif /* !READ_UNKNOWN_CHUNKS */ 2954| | 2955| | /* Check for unhandled critical chunks */ 2956| 4.33k| if (handled < handled_saved && PNG_CHUNK_CRITICAL(png_ptr->chunk_name)) ------------------ | | 942| 3.33k|#define PNG_CHUNK_CRITICAL(c) (!PNG_CHUNK_ANCILLARY(c)) | | ------------------ | | | | 941| 3.33k|#define PNG_CHUNK_ANCILLARY(c) (1 & ((c) >> 29)) | | ------------------ | | | Branch (942:35): [True: 1, False: 3.33k] | | ------------------ ------------------ | Branch (2956:8): [True: 3.33k, False: 996] ------------------ 2957| 1| png_chunk_error(png_ptr, "unhandled critical chunk"); ------------------ | | 239| 1|#define png_chunk_error OSS_FUZZ_png_chunk_error ------------------ 2958| | 2959| 4.33k| return handled; 2960| 4.33k|} OSS_FUZZ_png_handle_chunk: 3108| 96.3k|{ 3109| | /* CSE: these things don't change, these autos are just to save typing and 3110| | * make the code more clear. 3111| | */ 3112| 96.3k| const png_uint_32 chunk_name = png_ptr->chunk_name; 3113| 96.3k| const png_index chunk_index = png_chunk_index_from_name(chunk_name); 3114| | 3115| 96.3k| png_handle_result_code handled = handled_error; 3116| 96.3k| png_const_charp errmsg = NULL; 3117| | 3118| | /* Is this a known chunk? If not there are no checks performed here; 3119| | * png_handle_unknown does the correct checks. This means that the values 3120| | * for known but unsupported chunks in the above table are not used here 3121| | * however the chunks_seen fields in png_struct are still set. 3122| | */ 3123| 96.3k| if (chunk_index == PNG_INDEX_unknown || ------------------ | Branch (3123:8): [True: 3.51k, False: 92.8k] ------------------ 3124| 92.8k| read_chunks[chunk_index].handler == NULL) ------------------ | Branch (3124:8): [True: 818, False: 92.0k] ------------------ 3125| 4.33k| { 3126| 4.33k| handled = png_handle_unknown( ------------------ | | 49| 4.33k|#define png_handle_unknown OSS_FUZZ_png_handle_unknown ------------------ 3127| 4.33k| png_ptr, info_ptr, length, PNG_HANDLE_CHUNK_AS_DEFAULT); ------------------ | | 2583| 4.33k|#define PNG_HANDLE_CHUNK_AS_DEFAULT 0 ------------------ 3128| 4.33k| } 3129| | 3130| | /* First check the position. The first check is historical; the stream must 3131| | * start with IHDR and anything else causes libpng to give up immediately. 3132| | */ 3133| 92.0k| else if (chunk_index != PNG_INDEX_IHDR && ------------------ | Branch (3133:13): [True: 86.6k, False: 5.36k] ------------------ 3134| 86.6k| (png_ptr->mode & PNG_HAVE_IHDR) == 0) ------------------ | | 642| 86.6k|#define PNG_HAVE_IHDR 0x01 ------------------ | Branch (3134:13): [True: 23, False: 86.6k] ------------------ 3135| 23| png_chunk_error(png_ptr, "missing IHDR"); /* NORETURN */ ------------------ | | 239| 23|#define png_chunk_error OSS_FUZZ_png_chunk_error ------------------ 3136| | 3137| | /* Before all the pos_before chunks, after all the pos_after chunks. */ 3138| 92.0k| else if (((png_ptr->mode & read_chunks[chunk_index].pos_before) != 0) || ------------------ | Branch (3138:13): [True: 460, False: 91.5k] ------------------ 3139| 91.5k| ((png_ptr->mode & read_chunks[chunk_index].pos_after) != ------------------ | Branch (3139:13): [True: 1, False: 91.5k] ------------------ 3140| 91.5k| read_chunks[chunk_index].pos_after)) 3141| 461| { 3142| 461| errmsg = "out of place"; 3143| 461| } 3144| | 3145| | /* Now check for duplicates: duplicated critical chunks also produce a 3146| | * full error. 3147| | */ 3148| 91.5k| else if (read_chunks[chunk_index].multiple == 0 && ------------------ | Branch (3148:13): [True: 38.9k, False: 52.6k] ------------------ 3149| 38.9k| png_file_has_chunk(png_ptr, chunk_index)) ------------------ | | 115| 38.9k| (((png_ptr)->chunks & png_chunk_flag_from_index(i)) != 0) | | ------------------ | | | | 108| 38.9k|#define png_chunk_flag_from_index(i) (0x80000000U >> (31 - (i))) | | ------------------ | | | Branch (115:4): [True: 2.15k, False: 36.7k] | | ------------------ ------------------ 3150| 2.15k| { 3151| 2.15k| errmsg = "duplicate"; 3152| 2.15k| } 3153| | 3154| 89.4k| else if (length < read_chunks[chunk_index].min_length) ------------------ | Branch (3154:13): [True: 1.47k, False: 87.9k] ------------------ 3155| 1.47k| errmsg = "too short"; 3156| 87.9k| else 3157| 87.9k| { 3158| | /* NOTE: apart from IHDR the critical chunks (PLTE, IDAT and IEND) are set 3159| | * up above not to do any length checks. 3160| | * 3161| | * The png_chunk_max check ensures that the variable length chunks are 3162| | * always checked at this point for being within the system allocation 3163| | * limits. 3164| | */ 3165| 87.9k| unsigned max_length = read_chunks[chunk_index].max_length; 3166| | 3167| 87.9k| switch (max_length) 3168| 87.9k| { 3169| 7.52k| case Limit: ------------------ | | 3023| 7.52k|# define Limit 0x802U /* Limit to png_chunk_max bytes */ ------------------ | Branch (3169:10): [True: 7.52k, False: 80.4k] ------------------ 3170| | /* png_read_chunk_header has already png_error'ed chunks with a 3171| | * length exceeding the 31-bit PNG limit, so just check the memory 3172| | * limit: 3173| | */ 3174| 7.52k| if (length <= png_chunk_max(png_ptr)) ------------------ | | 1126| 7.52k|# define png_chunk_max(png_ptr) ((png_ptr)->user_chunk_malloc_max) ------------------ | Branch (3174:17): [True: 7.51k, False: 10] ------------------ 3175| 7.51k| goto MeetsLimit; 3176| | 3177| 10| errmsg = "length exceeds libpng limit"; 3178| 10| break; 3179| | 3180| 19.0k| default: ------------------ | Branch (3180:10): [True: 19.0k, False: 68.8k] ------------------ 3181| 19.0k| if (length <= max_length) ------------------ | Branch (3181:17): [True: 18.7k, False: 286] ------------------ 3182| 18.7k| goto MeetsLimit; 3183| | 3184| 286| errmsg = "too long"; 3185| 286| break; 3186| | 3187| 61.3k| case NoCheck: ------------------ | | 3022| 61.3k|# define NoCheck 0x801U /* Do not check the maximum length */ ------------------ | Branch (3187:10): [True: 61.3k, False: 26.6k] ------------------ 3188| 87.6k| MeetsLimit: 3189| 87.6k| handled = read_chunks[chunk_index].handler( 3190| 87.6k| png_ptr, info_ptr, length); 3191| 87.6k| break; 3192| 87.9k| } 3193| 87.9k| } 3194| | 3195| | /* If there was an error or the chunk was simply skipped it is not counted as 3196| | * 'seen'. 3197| | */ 3198| 93.7k| if (errmsg != NULL) ------------------ | Branch (3198:8): [True: 4.38k, False: 89.3k] ------------------ 3199| 4.38k| { 3200| 4.38k| if (PNG_CHUNK_CRITICAL(chunk_name)) /* stop immediately */ ------------------ | | 942| 4.38k|#define PNG_CHUNK_CRITICAL(c) (!PNG_CHUNK_ANCILLARY(c)) | | ------------------ | | | | 941| 4.38k|#define PNG_CHUNK_ANCILLARY(c) (1 & ((c) >> 29)) | | ------------------ | | | Branch (942:35): [True: 55, False: 4.32k] | | ------------------ ------------------ 3201| 55| png_chunk_error(png_ptr, errmsg); ------------------ | | 239| 55|#define png_chunk_error OSS_FUZZ_png_chunk_error ------------------ 3202| 4.32k| else /* ancillary chunk */ 3203| 4.32k| { 3204| | /* The chunk data is skipped: */ 3205| 4.32k| png_crc_finish(png_ptr, length); ------------------ | | 25| 4.32k|#define png_crc_finish OSS_FUZZ_png_crc_finish ------------------ 3206| 4.32k| png_chunk_benign_error(png_ptr, errmsg); ------------------ | | 238| 4.32k|#define png_chunk_benign_error OSS_FUZZ_png_chunk_benign_error ------------------ 3207| 4.32k| } 3208| 4.38k| } 3209| | 3210| 89.3k| else if (handled >= handled_saved) ------------------ | Branch (3210:13): [True: 20.5k, False: 68.7k] ------------------ 3211| 20.5k| { 3212| 20.5k| if (chunk_index != PNG_INDEX_unknown) ------------------ | Branch (3212:11): [True: 20.5k, False: 0] ------------------ 3213| 20.5k| png_file_add_chunk(png_ptr, chunk_index); ------------------ | | 119| 20.5k| ((void)((png_ptr)->chunks |= png_chunk_flag_from_index(i))) | | ------------------ | | | | 108| 20.5k|#define png_chunk_flag_from_index(i) (0x80000000U >> (31 - (i))) | | ------------------ ------------------ 3214| 20.5k| } 3215| | 3216| 93.6k| return handled; 3217| 93.7k|} OSS_FUZZ_png_combine_row: 3228| 9.77k|{ 3229| 9.77k| unsigned int pixel_depth = png_ptr->transformed_pixel_depth; 3230| 9.77k| png_const_bytep sp = png_ptr->row_buf + 1; 3231| 9.77k| png_alloc_size_t row_width = png_ptr->width; 3232| 9.77k| unsigned int pass = png_ptr->pass; 3233| 9.77k| png_bytep end_ptr = 0; 3234| 9.77k| png_byte end_byte = 0; 3235| 9.77k| unsigned int end_mask; 3236| | 3237| 9.77k| png_debug(1, "in png_combine_row"); ------------------ | | 145| 9.77k|# define png_debug(l, m) ((void)0) ------------------ 3238| | 3239| | /* Added in 1.5.6: it should not be possible to enter this routine until at 3240| | * least one row has been read from the PNG data and transformed. 3241| | */ 3242| 9.77k| if (pixel_depth == 0) ------------------ | Branch (3242:8): [True: 0, False: 9.77k] ------------------ 3243| 0| png_error(png_ptr, "internal row logic error"); ------------------ | | 252| 0|#define png_error OSS_FUZZ_png_error ------------------ 3244| | 3245| | /* Added in 1.5.4: the pixel depth should match the information returned by 3246| | * any call to png_read_update_info at this point. Do not continue if we got 3247| | * this wrong. 3248| | */ 3249| 9.77k| if (png_ptr->info_rowbytes != 0 && png_ptr->info_rowbytes != ------------------ | Branch (3249:8): [True: 9.77k, False: 0] | Branch (3249:39): [True: 0, False: 9.77k] ------------------ 3250| 9.77k| PNG_ROWBYTES(pixel_depth, row_width)) ------------------ | | 755| 9.77k| ((pixel_bits) >= 8 ? \ | | ------------------ | | | Branch (755:6): [True: 9.77k, False: 0] | | ------------------ | | 756| 9.77k| ((size_t)(width) * (((size_t)(pixel_bits)) >> 3)) : \ | | 757| 9.77k| (( ((size_t)(width) * ((size_t)(pixel_bits))) + 7) >> 3) ) ------------------ 3251| 0| png_error(png_ptr, "internal row size calculation error"); ------------------ | | 252| 0|#define png_error OSS_FUZZ_png_error ------------------ 3252| | 3253| | /* Don't expect this to ever happen: */ 3254| 9.77k| if (row_width == 0) ------------------ | Branch (3254:8): [True: 0, False: 9.77k] ------------------ 3255| 0| png_error(png_ptr, "internal row width error"); ------------------ | | 252| 0|#define png_error OSS_FUZZ_png_error ------------------ 3256| | 3257| | /* Preserve the last byte in cases where only part of it will be overwritten, 3258| | * the multiply below may overflow, we don't care because ANSI-C guarantees 3259| | * we get the low bits. 3260| | */ 3261| 9.77k| end_mask = (pixel_depth * row_width) & 7; 3262| 9.77k| if (end_mask != 0) ------------------ | Branch (3262:8): [True: 0, False: 9.77k] ------------------ 3263| 0| { 3264| | /* end_ptr == NULL is a flag to say do nothing */ 3265| 0| end_ptr = dp + PNG_ROWBYTES(pixel_depth, row_width) - 1; ------------------ | | 755| 0| ((pixel_bits) >= 8 ? \ | | ------------------ | | | Branch (755:6): [True: 0, False: 0] | | ------------------ | | 756| 0| ((size_t)(width) * (((size_t)(pixel_bits)) >> 3)) : \ | | 757| 0| (( ((size_t)(width) * ((size_t)(pixel_bits))) + 7) >> 3) ) ------------------ 3266| 0| end_byte = *end_ptr; 3267| 0|# ifdef PNG_READ_PACKSWAP_SUPPORTED 3268| 0| if ((png_ptr->transformations & PNG_PACKSWAP) != 0) ------------------ | | 674| 0|#define PNG_PACKSWAP 0x10000U ------------------ | Branch (3268:11): [True: 0, False: 0] ------------------ 3269| | /* little-endian byte */ 3270| 0| end_mask = (unsigned int)(0xff << end_mask); 3271| | 3272| 0| else /* big-endian byte */ 3273| 0|# endif 3274| 0| end_mask = 0xff >> end_mask; 3275| | /* end_mask is now the bits to *keep* from the destination row */ 3276| 0| } 3277| | 3278| | /* For non-interlaced images this reduces to a memcpy(). A memcpy() 3279| | * will also happen if interlacing isn't supported or if the application 3280| | * does not call png_set_interlace_handling(). In the latter cases the 3281| | * caller just gets a sequence of the unexpanded rows from each interlace 3282| | * pass. 3283| | */ 3284| 9.77k|#ifdef PNG_READ_INTERLACING_SUPPORTED 3285| 9.77k| if (png_ptr->interlaced != 0 && ------------------ | Branch (3285:8): [True: 6.98k, False: 2.79k] ------------------ 3286| 6.98k| (png_ptr->transformations & PNG_INTERLACE) != 0 && ------------------ | | 659| 6.98k|#define PNG_INTERLACE 0x0002U ------------------ | Branch (3286:8): [True: 0, False: 6.98k] ------------------ 3287| 0| pass < 6 && (display == 0 || ------------------ | Branch (3287:8): [True: 0, False: 0] | Branch (3287:21): [True: 0, False: 0] ------------------ 3288| | /* The following copies everything for 'display' on passes 0, 2 and 4. */ 3289| 0| (display == 1 && (pass & 1) != 0))) ------------------ | Branch (3289:9): [True: 0, False: 0] | Branch (3289:25): [True: 0, False: 0] ------------------ 3290| 0| { 3291| | /* Narrow images may have no bits in a pass; the caller should handle 3292| | * this, but this test is cheap: 3293| | */ 3294| 0| if (row_width <= PNG_PASS_START_COL(pass)) ------------------ | | 2685| 0|#define PNG_PASS_START_COL(pass) (((1& (pass))<<(3-(((pass)+1)>>1)))&7) ------------------ | Branch (3294:11): [True: 0, False: 0] ------------------ 3295| 0| return; 3296| | 3297| 0| if (pixel_depth < 8) ------------------ | Branch (3297:11): [True: 0, False: 0] ------------------ 3298| 0| { 3299| | /* For pixel depths up to 4 bpp the 8-pixel mask can be expanded to fit 3300| | * into 32 bits, then a single loop over the bytes using the four byte 3301| | * values in the 32-bit mask can be used. For the 'display' option the 3302| | * expanded mask may also not require any masking within a byte. To 3303| | * make this work the PACKSWAP option must be taken into account - it 3304| | * simply requires the pixels to be reversed in each byte. 3305| | * 3306| | * The 'regular' case requires a mask for each of the first 6 passes, 3307| | * the 'display' case does a copy for the even passes in the range 3308| | * 0..6. This has already been handled in the test above. 3309| | * 3310| | * The masks are arranged as four bytes with the first byte to use in 3311| | * the lowest bits (little-endian) regardless of the order (PACKSWAP or 3312| | * not) of the pixels in each byte. 3313| | * 3314| | * NOTE: the whole of this logic depends on the caller of this function 3315| | * only calling it on rows appropriate to the pass. This function only 3316| | * understands the 'x' logic; the 'y' logic is handled by the caller. 3317| | * 3318| | * The following defines allow generation of compile time constant bit 3319| | * masks for each pixel depth and each possibility of swapped or not 3320| | * swapped bytes. Pass 'p' is in the range 0..6; 'x', a pixel index, 3321| | * is in the range 0..7; and the result is 1 if the pixel is to be 3322| | * copied in the pass, 0 if not. 'S' is for the sparkle method, 'B' 3323| | * for the block method. 3324| | * 3325| | * With some compilers a compile time expression of the general form: 3326| | * 3327| | * (shift >= 32) ? (a >> (shift-32)) : (b >> shift) 3328| | * 3329| | * Produces warnings with values of 'shift' in the range 33 to 63 3330| | * because the right hand side of the ?: expression is evaluated by 3331| | * the compiler even though it isn't used. Microsoft Visual C (various 3332| | * versions) and the Intel C compiler are known to do this. To avoid 3333| | * this the following macros are used in 1.5.6. This is a temporary 3334| | * solution to avoid destabilizing the code during the release process. 3335| | */ 3336| 0|# if PNG_USE_COMPILE_TIME_MASKS 3337| 0|# define PNG_LSR(x,s) ((x)>>((s) & 0x1f)) 3338| 0|# define PNG_LSL(x,s) ((x)<<((s) & 0x1f)) 3339| |# else 3340| |# define PNG_LSR(x,s) ((x)>>(s)) 3341| |# define PNG_LSL(x,s) ((x)<<(s)) 3342| |# endif 3343| 0|# define S_COPY(p,x) (((p)<4 ? PNG_LSR(0x80088822,(3-(p))*8+(7-(x))) :\ 3344| 0| PNG_LSR(0xaa55ff00,(7-(p))*8+(7-(x)))) & 1) 3345| 0|# define B_COPY(p,x) (((p)<4 ? PNG_LSR(0xff0fff33,(3-(p))*8+(7-(x))) :\ 3346| 0| PNG_LSR(0xff55ff00,(7-(p))*8+(7-(x)))) & 1) 3347| | 3348| | /* Return a mask for pass 'p' pixel 'x' at depth 'd'. The mask is 3349| | * little endian - the first pixel is at bit 0 - however the extra 3350| | * parameter 's' can be set to cause the mask position to be swapped 3351| | * within each byte, to match the PNG format. This is done by XOR of 3352| | * the shift with 7, 6 or 4 for bit depths 1, 2 and 4. 3353| | */ 3354| 0|# define PIXEL_MASK(p,x,d,s) \ 3355| 0| (PNG_LSL(((PNG_LSL(1U,(d)))-1),(((x)*(d))^((s)?8-(d):0)))) 3356| | 3357| | /* Hence generate the appropriate 'block' or 'sparkle' pixel copy mask. 3358| | */ 3359| 0|# define S_MASKx(p,x,d,s) (S_COPY(p,x)?PIXEL_MASK(p,x,d,s):0) 3360| 0|# define B_MASKx(p,x,d,s) (B_COPY(p,x)?PIXEL_MASK(p,x,d,s):0) 3361| | 3362| | /* Combine 8 of these to get the full mask. For the 1-bpp and 2-bpp 3363| | * cases the result needs replicating, for the 4-bpp case the above 3364| | * generates a full 32 bits. 3365| | */ 3366| 0|# define MASK_EXPAND(m,d) ((m)*((d)==1?0x01010101:((d)==2?0x00010001:1))) 3367| | 3368| 0|# define S_MASK(p,d,s) MASK_EXPAND(S_MASKx(p,0,d,s) + S_MASKx(p,1,d,s) +\ 3369| 0| S_MASKx(p,2,d,s) + S_MASKx(p,3,d,s) + S_MASKx(p,4,d,s) +\ 3370| 0| S_MASKx(p,5,d,s) + S_MASKx(p,6,d,s) + S_MASKx(p,7,d,s), d) 3371| | 3372| 0|# define B_MASK(p,d,s) MASK_EXPAND(B_MASKx(p,0,d,s) + B_MASKx(p,1,d,s) +\ 3373| 0| B_MASKx(p,2,d,s) + B_MASKx(p,3,d,s) + B_MASKx(p,4,d,s) +\ 3374| 0| B_MASKx(p,5,d,s) + B_MASKx(p,6,d,s) + B_MASKx(p,7,d,s), d) 3375| | 3376| 0|#if PNG_USE_COMPILE_TIME_MASKS 3377| | /* Utility macros to construct all the masks for a depth/swap 3378| | * combination. The 's' parameter says whether the format is PNG 3379| | * (big endian bytes) or not. Only the three odd-numbered passes are 3380| | * required for the display/block algorithm. 3381| | */ 3382| 0|# define S_MASKS(d,s) { S_MASK(0,d,s), S_MASK(1,d,s), S_MASK(2,d,s),\ 3383| 0| S_MASK(3,d,s), S_MASK(4,d,s), S_MASK(5,d,s) } 3384| | 3385| 0|# define B_MASKS(d,s) { B_MASK(1,d,s), B_MASK(3,d,s), B_MASK(5,d,s) } 3386| | 3387| 0|# define DEPTH_INDEX(d) ((d)==1?0:((d)==2?1:2)) 3388| | 3389| | /* Hence the pre-compiled masks indexed by PACKSWAP (or not), depth and 3390| | * then pass: 3391| | */ 3392| 0| static const png_uint_32 row_mask[2/*PACKSWAP*/][3/*depth*/][6] = 3393| 0| { 3394| | /* Little-endian byte masks for PACKSWAP */ 3395| 0| { S_MASKS(1,0), S_MASKS(2,0), S_MASKS(4,0) }, ------------------ | | 3382| 0|# define S_MASKS(d,s) { S_MASK(0,d,s), S_MASK(1,d,s), S_MASK(2,d,s),\ | | ------------------ | | | | 3368| 0|# define S_MASK(p,d,s) MASK_EXPAND(S_MASKx(p,0,d,s) + S_MASKx(p,1,d,s) +\ | | | | ------------------ | | | | | | 3366| 0|# define MASK_EXPAND(m,d) ((m)*((d)==1?0x01010101:((d)==2?0x00010001:1))) | | | | | | ------------------ | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:40): [True: 0, Folded] | | | | | | | Branch (3366:59): [Folded, False: 0] | | | | | | ------------------ | | | | ------------------ | | | | 3369| 0| S_MASKx(p,2,d,s) + S_MASKx(p,3,d,s) + S_MASKx(p,4,d,s) +\ | | | | 3370| 0| S_MASKx(p,5,d,s) + S_MASKx(p,6,d,s) + S_MASKx(p,7,d,s), d) | | ------------------ | | # define S_MASKS(d,s) { S_MASK(0,d,s), S_MASK(1,d,s), S_MASK(2,d,s),\ | | ------------------ | | | | 3368| 0|# define S_MASK(p,d,s) MASK_EXPAND(S_MASKx(p,0,d,s) + S_MASKx(p,1,d,s) +\ | | | | ------------------ | | | | | | 3366| 0|# define MASK_EXPAND(m,d) ((m)*((d)==1?0x01010101:((d)==2?0x00010001:1))) | | | | | | ------------------ | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:40): [True: 0, Folded] | | | | | | | Branch (3366:59): [Folded, False: 0] | | | | | | ------------------ | | | | ------------------ | | | | 3369| 0| S_MASKx(p,2,d,s) + S_MASKx(p,3,d,s) + S_MASKx(p,4,d,s) +\ | | | | 3370| 0| S_MASKx(p,5,d,s) + S_MASKx(p,6,d,s) + S_MASKx(p,7,d,s), d) | | ------------------ | | # define S_MASKS(d,s) { S_MASK(0,d,s), S_MASK(1,d,s), S_MASK(2,d,s),\ | | ------------------ | | | | 3368| 0|# define S_MASK(p,d,s) MASK_EXPAND(S_MASKx(p,0,d,s) + S_MASKx(p,1,d,s) +\ | | | | ------------------ | | | | | | 3366| 0|# define MASK_EXPAND(m,d) ((m)*((d)==1?0x01010101:((d)==2?0x00010001:1))) | | | | | | ------------------ | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:40): [True: 0, Folded] | | | | | | | Branch (3366:59): [Folded, False: 0] | | | | | | ------------------ | | | | ------------------ | | | | 3369| 0| S_MASKx(p,2,d,s) + S_MASKx(p,3,d,s) + S_MASKx(p,4,d,s) +\ | | | | 3370| 0| S_MASKx(p,5,d,s) + S_MASKx(p,6,d,s) + S_MASKx(p,7,d,s), d) | | ------------------ | | 3383| 0| S_MASK(3,d,s), S_MASK(4,d,s), S_MASK(5,d,s) } | | ------------------ | | | | 3368| 0|# define S_MASK(p,d,s) MASK_EXPAND(S_MASKx(p,0,d,s) + S_MASKx(p,1,d,s) +\ | | | | ------------------ | | | | | | 3366| 0|# define MASK_EXPAND(m,d) ((m)*((d)==1?0x01010101:((d)==2?0x00010001:1))) | | | | | | ------------------ | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:40): [True: 0, Folded] | | | | | | | Branch (3366:59): [Folded, False: 0] | | | | | | ------------------ | | | | ------------------ | | | | 3369| 0| S_MASKx(p,2,d,s) + S_MASKx(p,3,d,s) + S_MASKx(p,4,d,s) +\ | | | | 3370| 0| S_MASKx(p,5,d,s) + S_MASKx(p,6,d,s) + S_MASKx(p,7,d,s), d) | | ------------------ | | S_MASK(3,d,s), S_MASK(4,d,s), S_MASK(5,d,s) } | | ------------------ | | | | 3368| 0|# define S_MASK(p,d,s) MASK_EXPAND(S_MASKx(p,0,d,s) + S_MASKx(p,1,d,s) +\ | | | | ------------------ | | | | | | 3366| 0|# define MASK_EXPAND(m,d) ((m)*((d)==1?0x01010101:((d)==2?0x00010001:1))) | | | | | | ------------------ | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:40): [True: 0, Folded] | | | | | | | Branch (3366:59): [Folded, False: 0] | | | | | | ------------------ | | | | ------------------ | | | | 3369| 0| S_MASKx(p,2,d,s) + S_MASKx(p,3,d,s) + S_MASKx(p,4,d,s) +\ | | | | 3370| 0| S_MASKx(p,5,d,s) + S_MASKx(p,6,d,s) + S_MASKx(p,7,d,s), d) | | ------------------ | | S_MASK(3,d,s), S_MASK(4,d,s), S_MASK(5,d,s) } | | ------------------ | | | | 3368| 0|# define S_MASK(p,d,s) MASK_EXPAND(S_MASKx(p,0,d,s) + S_MASKx(p,1,d,s) +\ | | | | ------------------ | | | | | | 3366| 0|# define MASK_EXPAND(m,d) ((m)*((d)==1?0x01010101:((d)==2?0x00010001:1))) | | | | | | ------------------ | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:40): [True: 0, Folded] | | | | | | | Branch (3366:59): [Folded, False: 0] | | | | | | ------------------ | | | | ------------------ | | | | 3369| 0| S_MASKx(p,2,d,s) + S_MASKx(p,3,d,s) + S_MASKx(p,4,d,s) +\ | | | | 3370| 0| S_MASKx(p,5,d,s) + S_MASKx(p,6,d,s) + S_MASKx(p,7,d,s), d) | | ------------------ ------------------ { S_MASKS(1,0), S_MASKS(2,0), S_MASKS(4,0) }, ------------------ | | 3382| 0|# define S_MASKS(d,s) { S_MASK(0,d,s), S_MASK(1,d,s), S_MASK(2,d,s),\ | | ------------------ | | | | 3368| 0|# define S_MASK(p,d,s) MASK_EXPAND(S_MASKx(p,0,d,s) + S_MASKx(p,1,d,s) +\ | | | | ------------------ | | | | | | 3366| 0|# define MASK_EXPAND(m,d) ((m)*((d)==1?0x01010101:((d)==2?0x00010001:1))) | | | | | | ------------------ | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:40): [Folded, False: 0] | | | | | | | Branch (3366:59): [True: 0, Folded] | | | | | | ------------------ | | | | ------------------ | | | | 3369| 0| S_MASKx(p,2,d,s) + S_MASKx(p,3,d,s) + S_MASKx(p,4,d,s) +\ | | | | 3370| 0| S_MASKx(p,5,d,s) + S_MASKx(p,6,d,s) + S_MASKx(p,7,d,s), d) | | ------------------ | | # define S_MASKS(d,s) { S_MASK(0,d,s), S_MASK(1,d,s), S_MASK(2,d,s),\ | | ------------------ | | | | 3368| 0|# define S_MASK(p,d,s) MASK_EXPAND(S_MASKx(p,0,d,s) + S_MASKx(p,1,d,s) +\ | | | | ------------------ | | | | | | 3366| 0|# define MASK_EXPAND(m,d) ((m)*((d)==1?0x01010101:((d)==2?0x00010001:1))) | | | | | | ------------------ | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:40): [Folded, False: 0] | | | | | | | Branch (3366:59): [True: 0, Folded] | | | | | | ------------------ | | | | ------------------ | | | | 3369| 0| S_MASKx(p,2,d,s) + S_MASKx(p,3,d,s) + S_MASKx(p,4,d,s) +\ | | | | 3370| 0| S_MASKx(p,5,d,s) + S_MASKx(p,6,d,s) + S_MASKx(p,7,d,s), d) | | ------------------ | | # define S_MASKS(d,s) { S_MASK(0,d,s), S_MASK(1,d,s), S_MASK(2,d,s),\ | | ------------------ | | | | 3368| 0|# define S_MASK(p,d,s) MASK_EXPAND(S_MASKx(p,0,d,s) + S_MASKx(p,1,d,s) +\ | | | | ------------------ | | | | | | 3366| 0|# define MASK_EXPAND(m,d) ((m)*((d)==1?0x01010101:((d)==2?0x00010001:1))) | | | | | | ------------------ | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:40): [Folded, False: 0] | | | | | | | Branch (3366:59): [True: 0, Folded] | | | | | | ------------------ | | | | ------------------ | | | | 3369| 0| S_MASKx(p,2,d,s) + S_MASKx(p,3,d,s) + S_MASKx(p,4,d,s) +\ | | | | 3370| 0| S_MASKx(p,5,d,s) + S_MASKx(p,6,d,s) + S_MASKx(p,7,d,s), d) | | ------------------ | | 3383| 0| S_MASK(3,d,s), S_MASK(4,d,s), S_MASK(5,d,s) } | | ------------------ | | | | 3368| 0|# define S_MASK(p,d,s) MASK_EXPAND(S_MASKx(p,0,d,s) + S_MASKx(p,1,d,s) +\ | | | | ------------------ | | | | | | 3366| 0|# define MASK_EXPAND(m,d) ((m)*((d)==1?0x01010101:((d)==2?0x00010001:1))) | | | | | | ------------------ | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:40): [Folded, False: 0] | | | | | | | Branch (3366:59): [True: 0, Folded] | | | | | | ------------------ | | | | ------------------ | | | | 3369| 0| S_MASKx(p,2,d,s) + S_MASKx(p,3,d,s) + S_MASKx(p,4,d,s) +\ | | | | 3370| 0| S_MASKx(p,5,d,s) + S_MASKx(p,6,d,s) + S_MASKx(p,7,d,s), d) | | ------------------ | | S_MASK(3,d,s), S_MASK(4,d,s), S_MASK(5,d,s) } | | ------------------ | | | | 3368| 0|# define S_MASK(p,d,s) MASK_EXPAND(S_MASKx(p,0,d,s) + S_MASKx(p,1,d,s) +\ | | | | ------------------ | | | | | | 3366| 0|# define MASK_EXPAND(m,d) ((m)*((d)==1?0x01010101:((d)==2?0x00010001:1))) | | | | | | ------------------ | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:40): [Folded, False: 0] | | | | | | | Branch (3366:59): [True: 0, Folded] | | | | | | ------------------ | | | | ------------------ | | | | 3369| 0| S_MASKx(p,2,d,s) + S_MASKx(p,3,d,s) + S_MASKx(p,4,d,s) +\ | | | | 3370| 0| S_MASKx(p,5,d,s) + S_MASKx(p,6,d,s) + S_MASKx(p,7,d,s), d) | | ------------------ | | S_MASK(3,d,s), S_MASK(4,d,s), S_MASK(5,d,s) } | | ------------------ | | | | 3368| 0|# define S_MASK(p,d,s) MASK_EXPAND(S_MASKx(p,0,d,s) + S_MASKx(p,1,d,s) +\ | | | | ------------------ | | | | | | 3366| 0|# define MASK_EXPAND(m,d) ((m)*((d)==1?0x01010101:((d)==2?0x00010001:1))) | | | | | | ------------------ | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:40): [Folded, False: 0] | | | | | | | Branch (3366:59): [True: 0, Folded] | | | | | | ------------------ | | | | ------------------ | | | | 3369| 0| S_MASKx(p,2,d,s) + S_MASKx(p,3,d,s) + S_MASKx(p,4,d,s) +\ | | | | 3370| 0| S_MASKx(p,5,d,s) + S_MASKx(p,6,d,s) + S_MASKx(p,7,d,s), d) | | ------------------ ------------------ { S_MASKS(1,0), S_MASKS(2,0), S_MASKS(4,0) }, ------------------ | | 3382| 0|# define S_MASKS(d,s) { S_MASK(0,d,s), S_MASK(1,d,s), S_MASK(2,d,s),\ | | ------------------ | | | | 3368| 0|# define S_MASK(p,d,s) MASK_EXPAND(S_MASKx(p,0,d,s) + S_MASKx(p,1,d,s) +\ | | | | ------------------ | | | | | | 3366| 0|# define MASK_EXPAND(m,d) ((m)*((d)==1?0x01010101:((d)==2?0x00010001:1))) | | | | | | ------------------ | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:40): [Folded, False: 0] | | | | | | | Branch (3366:59): [Folded, False: 0] | | | | | | ------------------ | | | | ------------------ | | | | 3369| 0| S_MASKx(p,2,d,s) + S_MASKx(p,3,d,s) + S_MASKx(p,4,d,s) +\ | | | | 3370| 0| S_MASKx(p,5,d,s) + S_MASKx(p,6,d,s) + S_MASKx(p,7,d,s), d) | | ------------------ | | # define S_MASKS(d,s) { S_MASK(0,d,s), S_MASK(1,d,s), S_MASK(2,d,s),\ | | ------------------ | | | | 3368| 0|# define S_MASK(p,d,s) MASK_EXPAND(S_MASKx(p,0,d,s) + S_MASKx(p,1,d,s) +\ | | | | ------------------ | | | | | | 3366| 0|# define MASK_EXPAND(m,d) ((m)*((d)==1?0x01010101:((d)==2?0x00010001:1))) | | | | | | ------------------ | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:40): [Folded, False: 0] | | | | | | | Branch (3366:59): [Folded, False: 0] | | | | | | ------------------ | | | | ------------------ | | | | 3369| 0| S_MASKx(p,2,d,s) + S_MASKx(p,3,d,s) + S_MASKx(p,4,d,s) +\ | | | | 3370| 0| S_MASKx(p,5,d,s) + S_MASKx(p,6,d,s) + S_MASKx(p,7,d,s), d) | | ------------------ | | # define S_MASKS(d,s) { S_MASK(0,d,s), S_MASK(1,d,s), S_MASK(2,d,s),\ | | ------------------ | | | | 3368| 0|# define S_MASK(p,d,s) MASK_EXPAND(S_MASKx(p,0,d,s) + S_MASKx(p,1,d,s) +\ | | | | ------------------ | | | | | | 3366| 0|# define MASK_EXPAND(m,d) ((m)*((d)==1?0x01010101:((d)==2?0x00010001:1))) | | | | | | ------------------ | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:40): [Folded, False: 0] | | | | | | | Branch (3366:59): [Folded, False: 0] | | | | | | ------------------ | | | | ------------------ | | | | 3369| 0| S_MASKx(p,2,d,s) + S_MASKx(p,3,d,s) + S_MASKx(p,4,d,s) +\ | | | | 3370| 0| S_MASKx(p,5,d,s) + S_MASKx(p,6,d,s) + S_MASKx(p,7,d,s), d) | | ------------------ | | 3383| 0| S_MASK(3,d,s), S_MASK(4,d,s), S_MASK(5,d,s) } | | ------------------ | | | | 3368| 0|# define S_MASK(p,d,s) MASK_EXPAND(S_MASKx(p,0,d,s) + S_MASKx(p,1,d,s) +\ | | | | ------------------ | | | | | | 3366| 0|# define MASK_EXPAND(m,d) ((m)*((d)==1?0x01010101:((d)==2?0x00010001:1))) | | | | | | ------------------ | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:40): [Folded, False: 0] | | | | | | | Branch (3366:59): [Folded, False: 0] | | | | | | ------------------ | | | | ------------------ | | | | 3369| 0| S_MASKx(p,2,d,s) + S_MASKx(p,3,d,s) + S_MASKx(p,4,d,s) +\ | | | | 3370| 0| S_MASKx(p,5,d,s) + S_MASKx(p,6,d,s) + S_MASKx(p,7,d,s), d) | | ------------------ | | S_MASK(3,d,s), S_MASK(4,d,s), S_MASK(5,d,s) } | | ------------------ | | | | 3368| 0|# define S_MASK(p,d,s) MASK_EXPAND(S_MASKx(p,0,d,s) + S_MASKx(p,1,d,s) +\ | | | | ------------------ | | | | | | 3366| 0|# define MASK_EXPAND(m,d) ((m)*((d)==1?0x01010101:((d)==2?0x00010001:1))) | | | | | | ------------------ | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:40): [Folded, False: 0] | | | | | | | Branch (3366:59): [Folded, False: 0] | | | | | | ------------------ | | | | ------------------ | | | | 3369| 0| S_MASKx(p,2,d,s) + S_MASKx(p,3,d,s) + S_MASKx(p,4,d,s) +\ | | | | 3370| 0| S_MASKx(p,5,d,s) + S_MASKx(p,6,d,s) + S_MASKx(p,7,d,s), d) | | ------------------ | | S_MASK(3,d,s), S_MASK(4,d,s), S_MASK(5,d,s) } | | ------------------ | | | | 3368| 0|# define S_MASK(p,d,s) MASK_EXPAND(S_MASKx(p,0,d,s) + S_MASKx(p,1,d,s) +\ | | | | ------------------ | | | | | | 3366| 0|# define MASK_EXPAND(m,d) ((m)*((d)==1?0x01010101:((d)==2?0x00010001:1))) | | | | | | ------------------ | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:40): [Folded, False: 0] | | | | | | | Branch (3366:59): [Folded, False: 0] | | | | | | ------------------ | | | | ------------------ | | | | 3369| 0| S_MASKx(p,2,d,s) + S_MASKx(p,3,d,s) + S_MASKx(p,4,d,s) +\ | | | | 3370| 0| S_MASKx(p,5,d,s) + S_MASKx(p,6,d,s) + S_MASKx(p,7,d,s), d) | | ------------------ ------------------ 3396| | /* Normal (big-endian byte) masks - PNG format */ 3397| 0| { S_MASKS(1,1), S_MASKS(2,1), S_MASKS(4,1) } ------------------ | | 3382| 0|# define S_MASKS(d,s) { S_MASK(0,d,s), S_MASK(1,d,s), S_MASK(2,d,s),\ | | ------------------ | | | | 3368| 0|# define S_MASK(p,d,s) MASK_EXPAND(S_MASKx(p,0,d,s) + S_MASKx(p,1,d,s) +\ | | | | ------------------ | | | | | | 3366| 0|# define MASK_EXPAND(m,d) ((m)*((d)==1?0x01010101:((d)==2?0x00010001:1))) | | | | | | ------------------ | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:40): [True: 0, Folded] | | | | | | | Branch (3366:59): [Folded, False: 0] | | | | | | ------------------ | | | | ------------------ | | | | 3369| 0| S_MASKx(p,2,d,s) + S_MASKx(p,3,d,s) + S_MASKx(p,4,d,s) +\ | | | | 3370| 0| S_MASKx(p,5,d,s) + S_MASKx(p,6,d,s) + S_MASKx(p,7,d,s), d) | | ------------------ | | # define S_MASKS(d,s) { S_MASK(0,d,s), S_MASK(1,d,s), S_MASK(2,d,s),\ | | ------------------ | | | | 3368| 0|# define S_MASK(p,d,s) MASK_EXPAND(S_MASKx(p,0,d,s) + S_MASKx(p,1,d,s) +\ | | | | ------------------ | | | | | | 3366| 0|# define MASK_EXPAND(m,d) ((m)*((d)==1?0x01010101:((d)==2?0x00010001:1))) | | | | | | ------------------ | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:40): [True: 0, Folded] | | | | | | | Branch (3366:59): [Folded, False: 0] | | | | | | ------------------ | | | | ------------------ | | | | 3369| 0| S_MASKx(p,2,d,s) + S_MASKx(p,3,d,s) + S_MASKx(p,4,d,s) +\ | | | | 3370| 0| S_MASKx(p,5,d,s) + S_MASKx(p,6,d,s) + S_MASKx(p,7,d,s), d) | | ------------------ | | # define S_MASKS(d,s) { S_MASK(0,d,s), S_MASK(1,d,s), S_MASK(2,d,s),\ | | ------------------ | | | | 3368| 0|# define S_MASK(p,d,s) MASK_EXPAND(S_MASKx(p,0,d,s) + S_MASKx(p,1,d,s) +\ | | | | ------------------ | | | | | | 3366| 0|# define MASK_EXPAND(m,d) ((m)*((d)==1?0x01010101:((d)==2?0x00010001:1))) | | | | | | ------------------ | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:40): [True: 0, Folded] | | | | | | | Branch (3366:59): [Folded, False: 0] | | | | | | ------------------ | | | | ------------------ | | | | 3369| 0| S_MASKx(p,2,d,s) + S_MASKx(p,3,d,s) + S_MASKx(p,4,d,s) +\ | | | | 3370| 0| S_MASKx(p,5,d,s) + S_MASKx(p,6,d,s) + S_MASKx(p,7,d,s), d) | | ------------------ | | 3383| 0| S_MASK(3,d,s), S_MASK(4,d,s), S_MASK(5,d,s) } | | ------------------ | | | | 3368| 0|# define S_MASK(p,d,s) MASK_EXPAND(S_MASKx(p,0,d,s) + S_MASKx(p,1,d,s) +\ | | | | ------------------ | | | | | | 3366| 0|# define MASK_EXPAND(m,d) ((m)*((d)==1?0x01010101:((d)==2?0x00010001:1))) | | | | | | ------------------ | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:40): [True: 0, Folded] | | | | | | | Branch (3366:59): [Folded, False: 0] | | | | | | ------------------ | | | | ------------------ | | | | 3369| 0| S_MASKx(p,2,d,s) + S_MASKx(p,3,d,s) + S_MASKx(p,4,d,s) +\ | | | | 3370| 0| S_MASKx(p,5,d,s) + S_MASKx(p,6,d,s) + S_MASKx(p,7,d,s), d) | | ------------------ | | S_MASK(3,d,s), S_MASK(4,d,s), S_MASK(5,d,s) } | | ------------------ | | | | 3368| 0|# define S_MASK(p,d,s) MASK_EXPAND(S_MASKx(p,0,d,s) + S_MASKx(p,1,d,s) +\ | | | | ------------------ | | | | | | 3366| 0|# define MASK_EXPAND(m,d) ((m)*((d)==1?0x01010101:((d)==2?0x00010001:1))) | | | | | | ------------------ | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:40): [True: 0, Folded] | | | | | | | Branch (3366:59): [Folded, False: 0] | | | | | | ------------------ | | | | ------------------ | | | | 3369| 0| S_MASKx(p,2,d,s) + S_MASKx(p,3,d,s) + S_MASKx(p,4,d,s) +\ | | | | 3370| 0| S_MASKx(p,5,d,s) + S_MASKx(p,6,d,s) + S_MASKx(p,7,d,s), d) | | ------------------ | | S_MASK(3,d,s), S_MASK(4,d,s), S_MASK(5,d,s) } | | ------------------ | | | | 3368| 0|# define S_MASK(p,d,s) MASK_EXPAND(S_MASKx(p,0,d,s) + S_MASKx(p,1,d,s) +\ | | | | ------------------ | | | | | | 3366| 0|# define MASK_EXPAND(m,d) ((m)*((d)==1?0x01010101:((d)==2?0x00010001:1))) | | | | | | ------------------ | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:40): [True: 0, Folded] | | | | | | | Branch (3366:59): [Folded, False: 0] | | | | | | ------------------ | | | | ------------------ | | | | 3369| 0| S_MASKx(p,2,d,s) + S_MASKx(p,3,d,s) + S_MASKx(p,4,d,s) +\ | | | | 3370| 0| S_MASKx(p,5,d,s) + S_MASKx(p,6,d,s) + S_MASKx(p,7,d,s), d) | | ------------------ ------------------ { S_MASKS(1,1), S_MASKS(2,1), S_MASKS(4,1) } ------------------ | | 3382| 0|# define S_MASKS(d,s) { S_MASK(0,d,s), S_MASK(1,d,s), S_MASK(2,d,s),\ | | ------------------ | | | | 3368| 0|# define S_MASK(p,d,s) MASK_EXPAND(S_MASKx(p,0,d,s) + S_MASKx(p,1,d,s) +\ | | | | ------------------ | | | | | | 3366| 0|# define MASK_EXPAND(m,d) ((m)*((d)==1?0x01010101:((d)==2?0x00010001:1))) | | | | | | ------------------ | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:40): [Folded, False: 0] | | | | | | | Branch (3366:59): [True: 0, Folded] | | | | | | ------------------ | | | | ------------------ | | | | 3369| 0| S_MASKx(p,2,d,s) + S_MASKx(p,3,d,s) + S_MASKx(p,4,d,s) +\ | | | | 3370| 0| S_MASKx(p,5,d,s) + S_MASKx(p,6,d,s) + S_MASKx(p,7,d,s), d) | | ------------------ | | # define S_MASKS(d,s) { S_MASK(0,d,s), S_MASK(1,d,s), S_MASK(2,d,s),\ | | ------------------ | | | | 3368| 0|# define S_MASK(p,d,s) MASK_EXPAND(S_MASKx(p,0,d,s) + S_MASKx(p,1,d,s) +\ | | | | ------------------ | | | | | | 3366| 0|# define MASK_EXPAND(m,d) ((m)*((d)==1?0x01010101:((d)==2?0x00010001:1))) | | | | | | ------------------ | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:40): [Folded, False: 0] | | | | | | | Branch (3366:59): [True: 0, Folded] | | | | | | ------------------ | | | | ------------------ | | | | 3369| 0| S_MASKx(p,2,d,s) + S_MASKx(p,3,d,s) + S_MASKx(p,4,d,s) +\ | | | | 3370| 0| S_MASKx(p,5,d,s) + S_MASKx(p,6,d,s) + S_MASKx(p,7,d,s), d) | | ------------------ | | # define S_MASKS(d,s) { S_MASK(0,d,s), S_MASK(1,d,s), S_MASK(2,d,s),\ | | ------------------ | | | | 3368| 0|# define S_MASK(p,d,s) MASK_EXPAND(S_MASKx(p,0,d,s) + S_MASKx(p,1,d,s) +\ | | | | ------------------ | | | | | | 3366| 0|# define MASK_EXPAND(m,d) ((m)*((d)==1?0x01010101:((d)==2?0x00010001:1))) | | | | | | ------------------ | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:40): [Folded, False: 0] | | | | | | | Branch (3366:59): [True: 0, Folded] | | | | | | ------------------ | | | | ------------------ | | | | 3369| 0| S_MASKx(p,2,d,s) + S_MASKx(p,3,d,s) + S_MASKx(p,4,d,s) +\ | | | | 3370| 0| S_MASKx(p,5,d,s) + S_MASKx(p,6,d,s) + S_MASKx(p,7,d,s), d) | | ------------------ | | 3383| 0| S_MASK(3,d,s), S_MASK(4,d,s), S_MASK(5,d,s) } | | ------------------ | | | | 3368| 0|# define S_MASK(p,d,s) MASK_EXPAND(S_MASKx(p,0,d,s) + S_MASKx(p,1,d,s) +\ | | | | ------------------ | | | | | | 3366| 0|# define MASK_EXPAND(m,d) ((m)*((d)==1?0x01010101:((d)==2?0x00010001:1))) | | | | | | ------------------ | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:40): [Folded, False: 0] | | | | | | | Branch (3366:59): [True: 0, Folded] | | | | | | ------------------ | | | | ------------------ | | | | 3369| 0| S_MASKx(p,2,d,s) + S_MASKx(p,3,d,s) + S_MASKx(p,4,d,s) +\ | | | | 3370| 0| S_MASKx(p,5,d,s) + S_MASKx(p,6,d,s) + S_MASKx(p,7,d,s), d) | | ------------------ | | S_MASK(3,d,s), S_MASK(4,d,s), S_MASK(5,d,s) } | | ------------------ | | | | 3368| 0|# define S_MASK(p,d,s) MASK_EXPAND(S_MASKx(p,0,d,s) + S_MASKx(p,1,d,s) +\ | | | | ------------------ | | | | | | 3366| 0|# define MASK_EXPAND(m,d) ((m)*((d)==1?0x01010101:((d)==2?0x00010001:1))) | | | | | | ------------------ | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:40): [Folded, False: 0] | | | | | | | Branch (3366:59): [True: 0, Folded] | | | | | | ------------------ | | | | ------------------ | | | | 3369| 0| S_MASKx(p,2,d,s) + S_MASKx(p,3,d,s) + S_MASKx(p,4,d,s) +\ | | | | 3370| 0| S_MASKx(p,5,d,s) + S_MASKx(p,6,d,s) + S_MASKx(p,7,d,s), d) | | ------------------ | | S_MASK(3,d,s), S_MASK(4,d,s), S_MASK(5,d,s) } | | ------------------ | | | | 3368| 0|# define S_MASK(p,d,s) MASK_EXPAND(S_MASKx(p,0,d,s) + S_MASKx(p,1,d,s) +\ | | | | ------------------ | | | | | | 3366| 0|# define MASK_EXPAND(m,d) ((m)*((d)==1?0x01010101:((d)==2?0x00010001:1))) | | | | | | ------------------ | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:40): [Folded, False: 0] | | | | | | | Branch (3366:59): [True: 0, Folded] | | | | | | ------------------ | | | | ------------------ | | | | 3369| 0| S_MASKx(p,2,d,s) + S_MASKx(p,3,d,s) + S_MASKx(p,4,d,s) +\ | | | | 3370| 0| S_MASKx(p,5,d,s) + S_MASKx(p,6,d,s) + S_MASKx(p,7,d,s), d) | | ------------------ ------------------ { S_MASKS(1,1), S_MASKS(2,1), S_MASKS(4,1) } ------------------ | | 3382| 0|# define S_MASKS(d,s) { S_MASK(0,d,s), S_MASK(1,d,s), S_MASK(2,d,s),\ | | ------------------ | | | | 3368| 0|# define S_MASK(p,d,s) MASK_EXPAND(S_MASKx(p,0,d,s) + S_MASKx(p,1,d,s) +\ | | | | ------------------ | | | | | | 3366| 0|# define MASK_EXPAND(m,d) ((m)*((d)==1?0x01010101:((d)==2?0x00010001:1))) | | | | | | ------------------ | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:40): [Folded, False: 0] | | | | | | | Branch (3366:59): [Folded, False: 0] | | | | | | ------------------ | | | | ------------------ | | | | 3369| 0| S_MASKx(p,2,d,s) + S_MASKx(p,3,d,s) + S_MASKx(p,4,d,s) +\ | | | | 3370| 0| S_MASKx(p,5,d,s) + S_MASKx(p,6,d,s) + S_MASKx(p,7,d,s), d) | | ------------------ | | # define S_MASKS(d,s) { S_MASK(0,d,s), S_MASK(1,d,s), S_MASK(2,d,s),\ | | ------------------ | | | | 3368| 0|# define S_MASK(p,d,s) MASK_EXPAND(S_MASKx(p,0,d,s) + S_MASKx(p,1,d,s) +\ | | | | ------------------ | | | | | | 3366| 0|# define MASK_EXPAND(m,d) ((m)*((d)==1?0x01010101:((d)==2?0x00010001:1))) | | | | | | ------------------ | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:40): [Folded, False: 0] | | | | | | | Branch (3366:59): [Folded, False: 0] | | | | | | ------------------ | | | | ------------------ | | | | 3369| 0| S_MASKx(p,2,d,s) + S_MASKx(p,3,d,s) + S_MASKx(p,4,d,s) +\ | | | | 3370| 0| S_MASKx(p,5,d,s) + S_MASKx(p,6,d,s) + S_MASKx(p,7,d,s), d) | | ------------------ | | # define S_MASKS(d,s) { S_MASK(0,d,s), S_MASK(1,d,s), S_MASK(2,d,s),\ | | ------------------ | | | | 3368| 0|# define S_MASK(p,d,s) MASK_EXPAND(S_MASKx(p,0,d,s) + S_MASKx(p,1,d,s) +\ | | | | ------------------ | | | | | | 3366| 0|# define MASK_EXPAND(m,d) ((m)*((d)==1?0x01010101:((d)==2?0x00010001:1))) | | | | | | ------------------ | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:40): [Folded, False: 0] | | | | | | | Branch (3366:59): [Folded, False: 0] | | | | | | ------------------ | | | | ------------------ | | | | 3369| 0| S_MASKx(p,2,d,s) + S_MASKx(p,3,d,s) + S_MASKx(p,4,d,s) +\ | | | | 3370| 0| S_MASKx(p,5,d,s) + S_MASKx(p,6,d,s) + S_MASKx(p,7,d,s), d) | | ------------------ | | 3383| 0| S_MASK(3,d,s), S_MASK(4,d,s), S_MASK(5,d,s) } | | ------------------ | | | | 3368| 0|# define S_MASK(p,d,s) MASK_EXPAND(S_MASKx(p,0,d,s) + S_MASKx(p,1,d,s) +\ | | | | ------------------ | | | | | | 3366| 0|# define MASK_EXPAND(m,d) ((m)*((d)==1?0x01010101:((d)==2?0x00010001:1))) | | | | | | ------------------ | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:40): [Folded, False: 0] | | | | | | | Branch (3366:59): [Folded, False: 0] | | | | | | ------------------ | | | | ------------------ | | | | 3369| 0| S_MASKx(p,2,d,s) + S_MASKx(p,3,d,s) + S_MASKx(p,4,d,s) +\ | | | | 3370| 0| S_MASKx(p,5,d,s) + S_MASKx(p,6,d,s) + S_MASKx(p,7,d,s), d) | | ------------------ | | S_MASK(3,d,s), S_MASK(4,d,s), S_MASK(5,d,s) } | | ------------------ | | | | 3368| 0|# define S_MASK(p,d,s) MASK_EXPAND(S_MASKx(p,0,d,s) + S_MASKx(p,1,d,s) +\ | | | | ------------------ | | | | | | 3366| 0|# define MASK_EXPAND(m,d) ((m)*((d)==1?0x01010101:((d)==2?0x00010001:1))) | | | | | | ------------------ | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:40): [Folded, False: 0] | | | | | | | Branch (3366:59): [Folded, False: 0] | | | | | | ------------------ | | | | ------------------ | | | | 3369| 0| S_MASKx(p,2,d,s) + S_MASKx(p,3,d,s) + S_MASKx(p,4,d,s) +\ | | | | 3370| 0| S_MASKx(p,5,d,s) + S_MASKx(p,6,d,s) + S_MASKx(p,7,d,s), d) | | ------------------ | | S_MASK(3,d,s), S_MASK(4,d,s), S_MASK(5,d,s) } | | ------------------ | | | | 3368| 0|# define S_MASK(p,d,s) MASK_EXPAND(S_MASKx(p,0,d,s) + S_MASKx(p,1,d,s) +\ | | | | ------------------ | | | | | | 3366| 0|# define MASK_EXPAND(m,d) ((m)*((d)==1?0x01010101:((d)==2?0x00010001:1))) | | | | | | ------------------ | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:40): [Folded, False: 0] | | | | | | | Branch (3366:59): [Folded, False: 0] | | | | | | ------------------ | | | | ------------------ | | | | 3369| 0| S_MASKx(p,2,d,s) + S_MASKx(p,3,d,s) + S_MASKx(p,4,d,s) +\ | | | | 3370| 0| S_MASKx(p,5,d,s) + S_MASKx(p,6,d,s) + S_MASKx(p,7,d,s), d) | | ------------------ ------------------ 3398| 0| }; 3399| | 3400| | /* display_mask has only three entries for the odd passes, so index by 3401| | * pass>>1. 3402| | */ 3403| 0| static const png_uint_32 display_mask[2][3][3] = 3404| 0| { 3405| | /* Little-endian byte masks for PACKSWAP */ 3406| 0| { B_MASKS(1,0), B_MASKS(2,0), B_MASKS(4,0) }, ------------------ | | 3385| 0|# define B_MASKS(d,s) { B_MASK(1,d,s), B_MASK(3,d,s), B_MASK(5,d,s) } | | ------------------ | | | | 3372| 0|# define B_MASK(p,d,s) MASK_EXPAND(B_MASKx(p,0,d,s) + B_MASKx(p,1,d,s) +\ | | | | ------------------ | | | | | | 3366| 0|# define MASK_EXPAND(m,d) ((m)*((d)==1?0x01010101:((d)==2?0x00010001:1))) | | | | | | ------------------ | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:40): [True: 0, Folded] | | | | | | | Branch (3366:59): [Folded, False: 0] | | | | | | ------------------ | | | | ------------------ | | | | 3373| 0| B_MASKx(p,2,d,s) + B_MASKx(p,3,d,s) + B_MASKx(p,4,d,s) +\ | | | | 3374| 0| B_MASKx(p,5,d,s) + B_MASKx(p,6,d,s) + B_MASKx(p,7,d,s), d) | | ------------------ | | # define B_MASKS(d,s) { B_MASK(1,d,s), B_MASK(3,d,s), B_MASK(5,d,s) } | | ------------------ | | | | 3372| 0|# define B_MASK(p,d,s) MASK_EXPAND(B_MASKx(p,0,d,s) + B_MASKx(p,1,d,s) +\ | | | | ------------------ | | | | | | 3366| 0|# define MASK_EXPAND(m,d) ((m)*((d)==1?0x01010101:((d)==2?0x00010001:1))) | | | | | | ------------------ | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:40): [True: 0, Folded] | | | | | | | Branch (3366:59): [Folded, False: 0] | | | | | | ------------------ | | | | ------------------ | | | | 3373| 0| B_MASKx(p,2,d,s) + B_MASKx(p,3,d,s) + B_MASKx(p,4,d,s) +\ | | | | 3374| 0| B_MASKx(p,5,d,s) + B_MASKx(p,6,d,s) + B_MASKx(p,7,d,s), d) | | ------------------ | | # define B_MASKS(d,s) { B_MASK(1,d,s), B_MASK(3,d,s), B_MASK(5,d,s) } | | ------------------ | | | | 3372| 0|# define B_MASK(p,d,s) MASK_EXPAND(B_MASKx(p,0,d,s) + B_MASKx(p,1,d,s) +\ | | | | ------------------ | | | | | | 3366| 0|# define MASK_EXPAND(m,d) ((m)*((d)==1?0x01010101:((d)==2?0x00010001:1))) | | | | | | ------------------ | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:40): [True: 0, Folded] | | | | | | | Branch (3366:59): [Folded, False: 0] | | | | | | ------------------ | | | | ------------------ | | | | 3373| 0| B_MASKx(p,2,d,s) + B_MASKx(p,3,d,s) + B_MASKx(p,4,d,s) +\ | | | | 3374| 0| B_MASKx(p,5,d,s) + B_MASKx(p,6,d,s) + B_MASKx(p,7,d,s), d) | | ------------------ ------------------ { B_MASKS(1,0), B_MASKS(2,0), B_MASKS(4,0) }, ------------------ | | 3385| 0|# define B_MASKS(d,s) { B_MASK(1,d,s), B_MASK(3,d,s), B_MASK(5,d,s) } | | ------------------ | | | | 3372| 0|# define B_MASK(p,d,s) MASK_EXPAND(B_MASKx(p,0,d,s) + B_MASKx(p,1,d,s) +\ | | | | ------------------ | | | | | | 3366| 0|# define MASK_EXPAND(m,d) ((m)*((d)==1?0x01010101:((d)==2?0x00010001:1))) | | | | | | ------------------ | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:40): [Folded, False: 0] | | | | | | | Branch (3366:59): [True: 0, Folded] | | | | | | ------------------ | | | | ------------------ | | | | 3373| 0| B_MASKx(p,2,d,s) + B_MASKx(p,3,d,s) + B_MASKx(p,4,d,s) +\ | | | | 3374| 0| B_MASKx(p,5,d,s) + B_MASKx(p,6,d,s) + B_MASKx(p,7,d,s), d) | | ------------------ | | # define B_MASKS(d,s) { B_MASK(1,d,s), B_MASK(3,d,s), B_MASK(5,d,s) } | | ------------------ | | | | 3372| 0|# define B_MASK(p,d,s) MASK_EXPAND(B_MASKx(p,0,d,s) + B_MASKx(p,1,d,s) +\ | | | | ------------------ | | | | | | 3366| 0|# define MASK_EXPAND(m,d) ((m)*((d)==1?0x01010101:((d)==2?0x00010001:1))) | | | | | | ------------------ | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:40): [Folded, False: 0] | | | | | | | Branch (3366:59): [True: 0, Folded] | | | | | | ------------------ | | | | ------------------ | | | | 3373| 0| B_MASKx(p,2,d,s) + B_MASKx(p,3,d,s) + B_MASKx(p,4,d,s) +\ | | | | 3374| 0| B_MASKx(p,5,d,s) + B_MASKx(p,6,d,s) + B_MASKx(p,7,d,s), d) | | ------------------ | | # define B_MASKS(d,s) { B_MASK(1,d,s), B_MASK(3,d,s), B_MASK(5,d,s) } | | ------------------ | | | | 3372| 0|# define B_MASK(p,d,s) MASK_EXPAND(B_MASKx(p,0,d,s) + B_MASKx(p,1,d,s) +\ | | | | ------------------ | | | | | | 3366| 0|# define MASK_EXPAND(m,d) ((m)*((d)==1?0x01010101:((d)==2?0x00010001:1))) | | | | | | ------------------ | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:40): [Folded, False: 0] | | | | | | | Branch (3366:59): [True: 0, Folded] | | | | | | ------------------ | | | | ------------------ | | | | 3373| 0| B_MASKx(p,2,d,s) + B_MASKx(p,3,d,s) + B_MASKx(p,4,d,s) +\ | | | | 3374| 0| B_MASKx(p,5,d,s) + B_MASKx(p,6,d,s) + B_MASKx(p,7,d,s), d) | | ------------------ ------------------ { B_MASKS(1,0), B_MASKS(2,0), B_MASKS(4,0) }, ------------------ | | 3385| 0|# define B_MASKS(d,s) { B_MASK(1,d,s), B_MASK(3,d,s), B_MASK(5,d,s) } | | ------------------ | | | | 3372| 0|# define B_MASK(p,d,s) MASK_EXPAND(B_MASKx(p,0,d,s) + B_MASKx(p,1,d,s) +\ | | | | ------------------ | | | | | | 3366| 0|# define MASK_EXPAND(m,d) ((m)*((d)==1?0x01010101:((d)==2?0x00010001:1))) | | | | | | ------------------ | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:40): [Folded, False: 0] | | | | | | | Branch (3366:59): [Folded, False: 0] | | | | | | ------------------ | | | | ------------------ | | | | 3373| 0| B_MASKx(p,2,d,s) + B_MASKx(p,3,d,s) + B_MASKx(p,4,d,s) +\ | | | | 3374| 0| B_MASKx(p,5,d,s) + B_MASKx(p,6,d,s) + B_MASKx(p,7,d,s), d) | | ------------------ | | # define B_MASKS(d,s) { B_MASK(1,d,s), B_MASK(3,d,s), B_MASK(5,d,s) } | | ------------------ | | | | 3372| 0|# define B_MASK(p,d,s) MASK_EXPAND(B_MASKx(p,0,d,s) + B_MASKx(p,1,d,s) +\ | | | | ------------------ | | | | | | 3366| 0|# define MASK_EXPAND(m,d) ((m)*((d)==1?0x01010101:((d)==2?0x00010001:1))) | | | | | | ------------------ | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:40): [Folded, False: 0] | | | | | | | Branch (3366:59): [Folded, False: 0] | | | | | | ------------------ | | | | ------------------ | | | | 3373| 0| B_MASKx(p,2,d,s) + B_MASKx(p,3,d,s) + B_MASKx(p,4,d,s) +\ | | | | 3374| 0| B_MASKx(p,5,d,s) + B_MASKx(p,6,d,s) + B_MASKx(p,7,d,s), d) | | ------------------ | | # define B_MASKS(d,s) { B_MASK(1,d,s), B_MASK(3,d,s), B_MASK(5,d,s) } | | ------------------ | | | | 3372| 0|# define B_MASK(p,d,s) MASK_EXPAND(B_MASKx(p,0,d,s) + B_MASKx(p,1,d,s) +\ | | | | ------------------ | | | | | | 3366| 0|# define MASK_EXPAND(m,d) ((m)*((d)==1?0x01010101:((d)==2?0x00010001:1))) | | | | | | ------------------ | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:40): [Folded, False: 0] | | | | | | | Branch (3366:59): [Folded, False: 0] | | | | | | ------------------ | | | | ------------------ | | | | 3373| 0| B_MASKx(p,2,d,s) + B_MASKx(p,3,d,s) + B_MASKx(p,4,d,s) +\ | | | | 3374| 0| B_MASKx(p,5,d,s) + B_MASKx(p,6,d,s) + B_MASKx(p,7,d,s), d) | | ------------------ ------------------ 3407| | /* Normal (big-endian byte) masks - PNG format */ 3408| 0| { B_MASKS(1,1), B_MASKS(2,1), B_MASKS(4,1) } ------------------ | | 3385| 0|# define B_MASKS(d,s) { B_MASK(1,d,s), B_MASK(3,d,s), B_MASK(5,d,s) } | | ------------------ | | | | 3372| 0|# define B_MASK(p,d,s) MASK_EXPAND(B_MASKx(p,0,d,s) + B_MASKx(p,1,d,s) +\ | | | | ------------------ | | | | | | 3366| 0|# define MASK_EXPAND(m,d) ((m)*((d)==1?0x01010101:((d)==2?0x00010001:1))) | | | | | | ------------------ | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:40): [True: 0, Folded] | | | | | | | Branch (3366:59): [Folded, False: 0] | | | | | | ------------------ | | | | ------------------ | | | | 3373| 0| B_MASKx(p,2,d,s) + B_MASKx(p,3,d,s) + B_MASKx(p,4,d,s) +\ | | | | 3374| 0| B_MASKx(p,5,d,s) + B_MASKx(p,6,d,s) + B_MASKx(p,7,d,s), d) | | ------------------ | | # define B_MASKS(d,s) { B_MASK(1,d,s), B_MASK(3,d,s), B_MASK(5,d,s) } | | ------------------ | | | | 3372| 0|# define B_MASK(p,d,s) MASK_EXPAND(B_MASKx(p,0,d,s) + B_MASKx(p,1,d,s) +\ | | | | ------------------ | | | | | | 3366| 0|# define MASK_EXPAND(m,d) ((m)*((d)==1?0x01010101:((d)==2?0x00010001:1))) | | | | | | ------------------ | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:40): [True: 0, Folded] | | | | | | | Branch (3366:59): [Folded, False: 0] | | | | | | ------------------ | | | | ------------------ | | | | 3373| 0| B_MASKx(p,2,d,s) + B_MASKx(p,3,d,s) + B_MASKx(p,4,d,s) +\ | | | | 3374| 0| B_MASKx(p,5,d,s) + B_MASKx(p,6,d,s) + B_MASKx(p,7,d,s), d) | | ------------------ | | # define B_MASKS(d,s) { B_MASK(1,d,s), B_MASK(3,d,s), B_MASK(5,d,s) } | | ------------------ | | | | 3372| 0|# define B_MASK(p,d,s) MASK_EXPAND(B_MASKx(p,0,d,s) + B_MASKx(p,1,d,s) +\ | | | | ------------------ | | | | | | 3366| 0|# define MASK_EXPAND(m,d) ((m)*((d)==1?0x01010101:((d)==2?0x00010001:1))) | | | | | | ------------------ | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:40): [True: 0, Folded] | | | | | | | Branch (3366:59): [Folded, False: 0] | | | | | | ------------------ | | | | ------------------ | | | | 3373| 0| B_MASKx(p,2,d,s) + B_MASKx(p,3,d,s) + B_MASKx(p,4,d,s) +\ | | | | 3374| 0| B_MASKx(p,5,d,s) + B_MASKx(p,6,d,s) + B_MASKx(p,7,d,s), d) | | ------------------ ------------------ { B_MASKS(1,1), B_MASKS(2,1), B_MASKS(4,1) } ------------------ | | 3385| 0|# define B_MASKS(d,s) { B_MASK(1,d,s), B_MASK(3,d,s), B_MASK(5,d,s) } | | ------------------ | | | | 3372| 0|# define B_MASK(p,d,s) MASK_EXPAND(B_MASKx(p,0,d,s) + B_MASKx(p,1,d,s) +\ | | | | ------------------ | | | | | | 3366| 0|# define MASK_EXPAND(m,d) ((m)*((d)==1?0x01010101:((d)==2?0x00010001:1))) | | | | | | ------------------ | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:40): [Folded, False: 0] | | | | | | | Branch (3366:59): [True: 0, Folded] | | | | | | ------------------ | | | | ------------------ | | | | 3373| 0| B_MASKx(p,2,d,s) + B_MASKx(p,3,d,s) + B_MASKx(p,4,d,s) +\ | | | | 3374| 0| B_MASKx(p,5,d,s) + B_MASKx(p,6,d,s) + B_MASKx(p,7,d,s), d) | | ------------------ | | # define B_MASKS(d,s) { B_MASK(1,d,s), B_MASK(3,d,s), B_MASK(5,d,s) } | | ------------------ | | | | 3372| 0|# define B_MASK(p,d,s) MASK_EXPAND(B_MASKx(p,0,d,s) + B_MASKx(p,1,d,s) +\ | | | | ------------------ | | | | | | 3366| 0|# define MASK_EXPAND(m,d) ((m)*((d)==1?0x01010101:((d)==2?0x00010001:1))) | | | | | | ------------------ | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:40): [Folded, False: 0] | | | | | | | Branch (3366:59): [True: 0, Folded] | | | | | | ------------------ | | | | ------------------ | | | | 3373| 0| B_MASKx(p,2,d,s) + B_MASKx(p,3,d,s) + B_MASKx(p,4,d,s) +\ | | | | 3374| 0| B_MASKx(p,5,d,s) + B_MASKx(p,6,d,s) + B_MASKx(p,7,d,s), d) | | ------------------ | | # define B_MASKS(d,s) { B_MASK(1,d,s), B_MASK(3,d,s), B_MASK(5,d,s) } | | ------------------ | | | | 3372| 0|# define B_MASK(p,d,s) MASK_EXPAND(B_MASKx(p,0,d,s) + B_MASKx(p,1,d,s) +\ | | | | ------------------ | | | | | | 3366| 0|# define MASK_EXPAND(m,d) ((m)*((d)==1?0x01010101:((d)==2?0x00010001:1))) | | | | | | ------------------ | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:40): [Folded, False: 0] | | | | | | | Branch (3366:59): [True: 0, Folded] | | | | | | ------------------ | | | | ------------------ | | | | 3373| 0| B_MASKx(p,2,d,s) + B_MASKx(p,3,d,s) + B_MASKx(p,4,d,s) +\ | | | | 3374| 0| B_MASKx(p,5,d,s) + B_MASKx(p,6,d,s) + B_MASKx(p,7,d,s), d) | | ------------------ ------------------ { B_MASKS(1,1), B_MASKS(2,1), B_MASKS(4,1) } ------------------ | | 3385| 0|# define B_MASKS(d,s) { B_MASK(1,d,s), B_MASK(3,d,s), B_MASK(5,d,s) } | | ------------------ | | | | 3372| 0|# define B_MASK(p,d,s) MASK_EXPAND(B_MASKx(p,0,d,s) + B_MASKx(p,1,d,s) +\ | | | | ------------------ | | | | | | 3366| 0|# define MASK_EXPAND(m,d) ((m)*((d)==1?0x01010101:((d)==2?0x00010001:1))) | | | | | | ------------------ | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:40): [Folded, False: 0] | | | | | | | Branch (3366:59): [Folded, False: 0] | | | | | | ------------------ | | | | ------------------ | | | | 3373| 0| B_MASKx(p,2,d,s) + B_MASKx(p,3,d,s) + B_MASKx(p,4,d,s) +\ | | | | 3374| 0| B_MASKx(p,5,d,s) + B_MASKx(p,6,d,s) + B_MASKx(p,7,d,s), d) | | ------------------ | | # define B_MASKS(d,s) { B_MASK(1,d,s), B_MASK(3,d,s), B_MASK(5,d,s) } | | ------------------ | | | | 3372| 0|# define B_MASK(p,d,s) MASK_EXPAND(B_MASKx(p,0,d,s) + B_MASKx(p,1,d,s) +\ | | | | ------------------ | | | | | | 3366| 0|# define MASK_EXPAND(m,d) ((m)*((d)==1?0x01010101:((d)==2?0x00010001:1))) | | | | | | ------------------ | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:40): [Folded, False: 0] | | | | | | | Branch (3366:59): [Folded, False: 0] | | | | | | ------------------ | | | | ------------------ | | | | 3373| 0| B_MASKx(p,2,d,s) + B_MASKx(p,3,d,s) + B_MASKx(p,4,d,s) +\ | | | | 3374| 0| B_MASKx(p,5,d,s) + B_MASKx(p,6,d,s) + B_MASKx(p,7,d,s), d) | | ------------------ | | # define B_MASKS(d,s) { B_MASK(1,d,s), B_MASK(3,d,s), B_MASK(5,d,s) } | | ------------------ | | | | 3372| 0|# define B_MASK(p,d,s) MASK_EXPAND(B_MASKx(p,0,d,s) + B_MASKx(p,1,d,s) +\ | | | | ------------------ | | | | | | 3366| 0|# define MASK_EXPAND(m,d) ((m)*((d)==1?0x01010101:((d)==2?0x00010001:1))) | | | | | | ------------------ | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [Folded, False: 0] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:36): [True: 0, Folded] | | | | | | | Branch (3366:40): [Folded, False: 0] | | | | | | | Branch (3366:59): [Folded, False: 0] | | | | | | ------------------ | | | | ------------------ | | | | 3373| 0| B_MASKx(p,2,d,s) + B_MASKx(p,3,d,s) + B_MASKx(p,4,d,s) +\ | | | | 3374| 0| B_MASKx(p,5,d,s) + B_MASKx(p,6,d,s) + B_MASKx(p,7,d,s), d) | | ------------------ ------------------ 3409| 0| }; 3410| | 3411| 0|# define MASK(pass,depth,display,png)\ 3412| 0| ((display)?display_mask[png][DEPTH_INDEX(depth)][pass>>1]:\ 3413| 0| row_mask[png][DEPTH_INDEX(depth)][pass]) 3414| | 3415| |#else /* !PNG_USE_COMPILE_TIME_MASKS */ 3416| | /* This is the runtime alternative: it seems unlikely that this will 3417| | * ever be either smaller or faster than the compile time approach. 3418| | */ 3419| |# define MASK(pass,depth,display,png)\ 3420| | ((display)?B_MASK(pass,depth,png):S_MASK(pass,depth,png)) 3421| |#endif /* !USE_COMPILE_TIME_MASKS */ 3422| | 3423| | /* Use the appropriate mask to copy the required bits. In some cases 3424| | * the byte mask will be 0 or 0xff; optimize these cases. row_width is 3425| | * the number of pixels, but the code copies bytes, so it is necessary 3426| | * to special case the end. 3427| | */ 3428| 0| png_uint_32 pixels_per_byte = 8 / pixel_depth; 3429| 0| png_uint_32 mask; 3430| | 3431| 0|# ifdef PNG_READ_PACKSWAP_SUPPORTED 3432| 0| if ((png_ptr->transformations & PNG_PACKSWAP) != 0) ------------------ | | 674| 0|#define PNG_PACKSWAP 0x10000U ------------------ | Branch (3432:14): [True: 0, False: 0] ------------------ 3433| 0| mask = MASK(pass, pixel_depth, display, 0); ------------------ | | 3412| 0| ((display)?display_mask[png][DEPTH_INDEX(depth)][pass>>1]:\ | | ------------------ | | | | 3387| 0|# define DEPTH_INDEX(d) ((d)==1?0:((d)==2?1:2)) | | | | ------------------ | | | | | Branch (3387:33): [True: 0, False: 0] | | | | | Branch (3387:43): [True: 0, False: 0] | | | | ------------------ | | ------------------ | | | Branch (3412:14): [True: 0, False: 0] | | ------------------ | | 3413| 0| row_mask[png][DEPTH_INDEX(depth)][pass]) | | ------------------ | | | | 3387| 0|# define DEPTH_INDEX(d) ((d)==1?0:((d)==2?1:2)) | | | | ------------------ | | | | | Branch (3387:33): [True: 0, False: 0] | | | | | Branch (3387:43): [True: 0, False: 0] | | | | ------------------ | | ------------------ ------------------ 3434| | 3435| 0| else 3436| 0|# endif 3437| 0| mask = MASK(pass, pixel_depth, display, 1); ------------------ | | 3412| 0| ((display)?display_mask[png][DEPTH_INDEX(depth)][pass>>1]:\ | | ------------------ | | | | 3387| 0|# define DEPTH_INDEX(d) ((d)==1?0:((d)==2?1:2)) | | | | ------------------ | | | | | Branch (3387:33): [True: 0, False: 0] | | | | | Branch (3387:43): [True: 0, False: 0] | | | | ------------------ | | ------------------ | | | Branch (3412:14): [True: 0, False: 0] | | ------------------ | | 3413| 0| row_mask[png][DEPTH_INDEX(depth)][pass]) | | ------------------ | | | | 3387| 0|# define DEPTH_INDEX(d) ((d)==1?0:((d)==2?1:2)) | | | | ------------------ | | | | | Branch (3387:33): [True: 0, False: 0] | | | | | Branch (3387:43): [True: 0, False: 0] | | | | ------------------ | | ------------------ ------------------ 3438| | 3439| 0| for (;;) 3440| 0| { 3441| 0| png_uint_32 m; 3442| | 3443| | /* It doesn't matter in the following if png_uint_32 has more than 3444| | * 32 bits because the high bits always match those in m<<24; it is, 3445| | * however, essential to use OR here, not +, because of this. 3446| | */ 3447| 0| m = mask; 3448| 0| mask = (m >> 8) | (m << 24); /* rotate right to good compilers */ 3449| 0| m &= 0xff; 3450| | 3451| 0| if (m != 0) /* something to copy */ ------------------ | Branch (3451:17): [True: 0, False: 0] ------------------ 3452| 0| { 3453| 0| if (m != 0xff) ------------------ | Branch (3453:20): [True: 0, False: 0] ------------------ 3454| 0| *dp = (png_byte)((*dp & ~m) | (*sp & m)); 3455| 0| else 3456| 0| *dp = *sp; 3457| 0| } 3458| | 3459| | /* NOTE: this may overwrite the last byte with garbage if the image 3460| | * is not an exact number of bytes wide; libpng has always done 3461| | * this. 3462| | */ 3463| 0| if (row_width <= pixels_per_byte) ------------------ | Branch (3463:17): [True: 0, False: 0] ------------------ 3464| 0| break; /* May need to restore part of the last byte */ 3465| | 3466| 0| row_width -= pixels_per_byte; 3467| 0| ++dp; 3468| 0| ++sp; 3469| 0| } 3470| 0| } 3471| | 3472| 0| else /* pixel_depth >= 8 */ 3473| 0| { 3474| 0| unsigned int bytes_to_copy, bytes_to_jump; 3475| | 3476| | /* Validate the depth - it must be a multiple of 8 */ 3477| 0| if (pixel_depth & 7) ------------------ | Branch (3477:14): [True: 0, False: 0] ------------------ 3478| 0| png_error(png_ptr, "invalid user transform pixel depth"); ------------------ | | 252| 0|#define png_error OSS_FUZZ_png_error ------------------ 3479| | 3480| 0| pixel_depth >>= 3; /* now in bytes */ 3481| 0| row_width *= pixel_depth; 3482| | 3483| | /* Regardless of pass number the Adam 7 interlace always results in a 3484| | * fixed number of pixels to copy then to skip. There may be a 3485| | * different number of pixels to skip at the start though. 3486| | */ 3487| 0| { 3488| 0| unsigned int offset = PNG_PASS_START_COL(pass) * pixel_depth; ------------------ | | 2685| 0|#define PNG_PASS_START_COL(pass) (((1& (pass))<<(3-(((pass)+1)>>1)))&7) ------------------ 3489| | 3490| 0| row_width -= offset; 3491| 0| dp += offset; 3492| 0| sp += offset; 3493| 0| } 3494| | 3495| | /* Work out the bytes to copy. */ 3496| 0| if (display != 0) ------------------ | Branch (3496:14): [True: 0, False: 0] ------------------ 3497| 0| { 3498| | /* When doing the 'block' algorithm the pixel in the pass gets 3499| | * replicated to adjacent pixels. This is why the even (0,2,4,6) 3500| | * passes are skipped above - the entire expanded row is copied. 3501| | */ 3502| 0| bytes_to_copy = (1<<((6-pass)>>1)) * pixel_depth; 3503| | 3504| | /* But don't allow this number to exceed the actual row width. */ 3505| 0| if (bytes_to_copy > row_width) ------------------ | Branch (3505:17): [True: 0, False: 0] ------------------ 3506| 0| bytes_to_copy = (unsigned int)/*SAFE*/row_width; 3507| 0| } 3508| | 3509| 0| else /* normal row; Adam7 only ever gives us one pixel to copy. */ 3510| 0| bytes_to_copy = pixel_depth; 3511| | 3512| | /* In Adam7 there is a constant offset between where the pixels go. */ 3513| 0| bytes_to_jump = PNG_PASS_COL_OFFSET(pass) * pixel_depth; ------------------ | | 2693| 0|#define PNG_PASS_COL_OFFSET(pass) (1<<((7-(pass))>>1)) ------------------ 3514| | 3515| | /* And simply copy these bytes. Some optimization is possible here, 3516| | * depending on the value of 'bytes_to_copy'. Special case the low 3517| | * byte counts, which we know to be frequent. 3518| | * 3519| | * Notice that these cases all 'return' rather than 'break' - this 3520| | * avoids an unnecessary test on whether to restore the last byte 3521| | * below. 3522| | */ 3523| 0| switch (bytes_to_copy) 3524| 0| { 3525| 0| case 1: ------------------ | Branch (3525:13): [True: 0, False: 0] ------------------ 3526| 0| for (;;) 3527| 0| { 3528| 0| *dp = *sp; 3529| | 3530| 0| if (row_width <= bytes_to_jump) ------------------ | Branch (3530:23): [True: 0, False: 0] ------------------ 3531| 0| return; 3532| | 3533| 0| dp += bytes_to_jump; 3534| 0| sp += bytes_to_jump; 3535| 0| row_width -= bytes_to_jump; 3536| 0| } 3537| | 3538| 0| case 2: ------------------ | Branch (3538:13): [True: 0, False: 0] ------------------ 3539| | /* There is a possibility of a partial copy at the end here; this 3540| | * slows the code down somewhat. 3541| | */ 3542| 0| do 3543| 0| { 3544| 0| dp[0] = sp[0]; dp[1] = sp[1]; 3545| | 3546| 0| if (row_width <= bytes_to_jump) ------------------ | Branch (3546:23): [True: 0, False: 0] ------------------ 3547| 0| return; 3548| | 3549| 0| sp += bytes_to_jump; 3550| 0| dp += bytes_to_jump; 3551| 0| row_width -= bytes_to_jump; 3552| 0| } 3553| 0| while (row_width > 1); ------------------ | Branch (3553:23): [True: 0, False: 0] ------------------ 3554| | 3555| | /* And there can only be one byte left at this point: */ 3556| 0| *dp = *sp; 3557| 0| return; 3558| | 3559| 0| case 3: ------------------ | Branch (3559:13): [True: 0, False: 0] ------------------ 3560| | /* This can only be the RGB case, so each copy is exactly one 3561| | * pixel and it is not necessary to check for a partial copy. 3562| | */ 3563| 0| for (;;) 3564| 0| { 3565| 0| dp[0] = sp[0]; dp[1] = sp[1]; dp[2] = sp[2]; 3566| | 3567| 0| if (row_width <= bytes_to_jump) ------------------ | Branch (3567:23): [True: 0, False: 0] ------------------ 3568| 0| return; 3569| | 3570| 0| sp += bytes_to_jump; 3571| 0| dp += bytes_to_jump; 3572| 0| row_width -= bytes_to_jump; 3573| 0| } 3574| | 3575| 0| default: ------------------ | Branch (3575:13): [True: 0, False: 0] ------------------ 3576| 0|#if PNG_ALIGN_TYPE != PNG_ALIGN_NONE 3577| | /* Check for double byte alignment and, if possible, use a 3578| | * 16-bit copy. Don't attempt this for narrow images - ones that 3579| | * are less than an interlace panel wide. Don't attempt it for 3580| | * wide bytes_to_copy either - use the memcpy there. 3581| | */ 3582| 0| if (bytes_to_copy < 16 /*else use memcpy*/ && ------------------ | Branch (3582:20): [True: 0, False: 0] ------------------ 3583| 0| png_isaligned(dp, png_uint_16) && ------------------ | | 623| 0| (((type)(size_t)((const void*)(ptr)) & (type)(png_alignof(type)-1)) == 0) | | ------------------ | | | | 608| 0|# define png_alignof(type) (sizeof(type)) | | ------------------ | | | Branch (623:4): [True: 0, False: 0] | | ------------------ ------------------ 3584| 0| png_isaligned(sp, png_uint_16) && ------------------ | | 623| 0| (((type)(size_t)((const void*)(ptr)) & (type)(png_alignof(type)-1)) == 0) | | ------------------ | | | | 608| 0|# define png_alignof(type) (sizeof(type)) | | ------------------ | | | Branch (623:4): [True: 0, False: 0] | | ------------------ ------------------ 3585| 0| bytes_to_copy % (sizeof (png_uint_16)) == 0 && ------------------ | Branch (3585:20): [True: 0, False: 0] ------------------ 3586| 0| bytes_to_jump % (sizeof (png_uint_16)) == 0) ------------------ | Branch (3586:20): [True: 0, False: 0] ------------------ 3587| 0| { 3588| | /* Everything is aligned for png_uint_16 copies, but try for 3589| | * png_uint_32 first. 3590| | */ 3591| 0| if (png_isaligned(dp, png_uint_32) && ------------------ | | 623| 0| (((type)(size_t)((const void*)(ptr)) & (type)(png_alignof(type)-1)) == 0) | | ------------------ | | | | 608| 0|# define png_alignof(type) (sizeof(type)) | | ------------------ | | | Branch (623:4): [True: 0, False: 0] | | ------------------ ------------------ 3592| 0| png_isaligned(sp, png_uint_32) && ------------------ | | 623| 0| (((type)(size_t)((const void*)(ptr)) & (type)(png_alignof(type)-1)) == 0) | | ------------------ | | | | 608| 0|# define png_alignof(type) (sizeof(type)) | | ------------------ | | | Branch (623:4): [True: 0, False: 0] | | ------------------ ------------------ 3593| 0| bytes_to_copy % (sizeof (png_uint_32)) == 0 && ------------------ | Branch (3593:23): [True: 0, False: 0] ------------------ 3594| 0| bytes_to_jump % (sizeof (png_uint_32)) == 0) ------------------ | Branch (3594:23): [True: 0, False: 0] ------------------ 3595| 0| { 3596| 0| png_uint_32p dp32 = png_aligncast(png_uint_32p,dp); ------------------ | | 537| 0|# define png_aligncast(type, value) ((void*)(value)) ------------------ 3597| 0| png_const_uint_32p sp32 = png_aligncastconst( ------------------ | | 538| 0|# define png_aligncastconst(type, value) ((const void*)(value)) ------------------ 3598| 0| png_const_uint_32p, sp); 3599| 0| size_t skip = (bytes_to_jump-bytes_to_copy) / 3600| 0| (sizeof (png_uint_32)); 3601| | 3602| 0| do 3603| 0| { 3604| 0| size_t c = bytes_to_copy; 3605| 0| do 3606| 0| { 3607| 0| *dp32++ = *sp32++; 3608| 0| c -= (sizeof (png_uint_32)); 3609| 0| } 3610| 0| while (c > 0); ------------------ | Branch (3610:32): [True: 0, False: 0] ------------------ 3611| | 3612| 0| if (row_width <= bytes_to_jump) ------------------ | Branch (3612:29): [True: 0, False: 0] ------------------ 3613| 0| return; 3614| | 3615| 0| dp32 += skip; 3616| 0| sp32 += skip; 3617| 0| row_width -= bytes_to_jump; 3618| 0| } 3619| 0| while (bytes_to_copy <= row_width); ------------------ | Branch (3619:29): [True: 0, False: 0] ------------------ 3620| | 3621| | /* Get to here when the row_width truncates the final copy. 3622| | * There will be 1-3 bytes left to copy, so don't try the 3623| | * 16-bit loop below. 3624| | */ 3625| 0| dp = (png_bytep)dp32; 3626| 0| sp = (png_const_bytep)sp32; 3627| 0| do 3628| 0| *dp++ = *sp++; 3629| 0| while (--row_width > 0); ------------------ | Branch (3629:29): [True: 0, False: 0] ------------------ 3630| 0| return; 3631| 0| } 3632| | 3633| | /* Else do it in 16-bit quantities, but only if the size is 3634| | * not too large. 3635| | */ 3636| 0| else 3637| 0| { 3638| 0| png_uint_16p dp16 = png_aligncast(png_uint_16p, dp); ------------------ | | 537| 0|# define png_aligncast(type, value) ((void*)(value)) ------------------ 3639| 0| png_const_uint_16p sp16 = png_aligncastconst( ------------------ | | 538| 0|# define png_aligncastconst(type, value) ((const void*)(value)) ------------------ 3640| 0| png_const_uint_16p, sp); 3641| 0| size_t skip = (bytes_to_jump-bytes_to_copy) / 3642| 0| (sizeof (png_uint_16)); 3643| | 3644| 0| do 3645| 0| { 3646| 0| size_t c = bytes_to_copy; 3647| 0| do 3648| 0| { 3649| 0| *dp16++ = *sp16++; 3650| 0| c -= (sizeof (png_uint_16)); 3651| 0| } 3652| 0| while (c > 0); ------------------ | Branch (3652:32): [True: 0, False: 0] ------------------ 3653| | 3654| 0| if (row_width <= bytes_to_jump) ------------------ | Branch (3654:29): [True: 0, False: 0] ------------------ 3655| 0| return; 3656| | 3657| 0| dp16 += skip; 3658| 0| sp16 += skip; 3659| 0| row_width -= bytes_to_jump; 3660| 0| } 3661| 0| while (bytes_to_copy <= row_width); ------------------ | Branch (3661:29): [True: 0, False: 0] ------------------ 3662| | 3663| | /* End of row - 1 byte left, bytes_to_copy > row_width: */ 3664| 0| dp = (png_bytep)dp16; 3665| 0| sp = (png_const_bytep)sp16; 3666| 0| do 3667| 0| *dp++ = *sp++; 3668| 0| while (--row_width > 0); ------------------ | Branch (3668:29): [True: 0, False: 0] ------------------ 3669| 0| return; 3670| 0| } 3671| 0| } 3672| 0|#endif /* ALIGN_TYPE code */ 3673| | 3674| | /* The true default - use a memcpy: */ 3675| 0| for (;;) 3676| 0| { 3677| 0| memcpy(dp, sp, bytes_to_copy); 3678| | 3679| 0| if (row_width <= bytes_to_jump) ------------------ | Branch (3679:23): [True: 0, False: 0] ------------------ 3680| 0| return; 3681| | 3682| 0| sp += bytes_to_jump; 3683| 0| dp += bytes_to_jump; 3684| 0| row_width -= bytes_to_jump; 3685| 0| if (bytes_to_copy > row_width) ------------------ | Branch (3685:23): [True: 0, False: 0] ------------------ 3686| 0| bytes_to_copy = (unsigned int)/*SAFE*/row_width; 3687| 0| } 3688| 0| } 3689| | 3690| | /* NOT REACHED*/ 3691| 0| } /* pixel_depth >= 8 */ 3692| | 3693| | /* Here if pixel_depth < 8 to check 'end_ptr' below. */ 3694| 0| } 3695| 9.77k| else 3696| 9.77k|#endif /* READ_INTERLACING */ 3697| | 3698| | /* If here then the switch above wasn't used so just memcpy the whole row 3699| | * from the temporary row buffer (notice that this overwrites the end of the 3700| | * destination row if it is a partial byte.) 3701| | */ 3702| 9.77k| memcpy(dp, sp, PNG_ROWBYTES(pixel_depth, row_width)); ------------------ | | 755| 9.77k| ((pixel_bits) >= 8 ? \ | | ------------------ | | | Branch (755:6): [True: 9.77k, False: 0] | | ------------------ | | 756| 9.77k| ((size_t)(width) * (((size_t)(pixel_bits)) >> 3)) : \ | | 757| 9.77k| (( ((size_t)(width) * ((size_t)(pixel_bits))) + 7) >> 3) ) ------------------ 3703| | 3704| | /* Restore the overwritten bits from the last byte if necessary. */ 3705| 9.77k| if (end_ptr != NULL) ------------------ | Branch (3705:8): [True: 0, False: 9.77k] ------------------ 3706| 0| *end_ptr = (png_byte)((end_byte & end_mask) | (*end_ptr & ~end_mask)); 3707| 9.77k|} OSS_FUZZ_png_read_filter_row: 4156| 6.80k|{ 4157| | /* OPTIMIZATION: DO NOT MODIFY THIS FUNCTION, instead #define 4158| | * PNG_FILTER_OPTIMIZATIONS to a function that overrides the generic 4159| | * implementations. See png_init_filter_functions above. 4160| | */ 4161| 6.80k| if (filter > PNG_FILTER_VALUE_NONE && filter < PNG_FILTER_VALUE_LAST) ------------------ | | 1541| 13.6k|#define PNG_FILTER_VALUE_NONE 0 ------------------ if (filter > PNG_FILTER_VALUE_NONE && filter < PNG_FILTER_VALUE_LAST) ------------------ | | 1546| 6.80k|#define PNG_FILTER_VALUE_LAST 5 ------------------ | Branch (4161:8): [True: 6.80k, False: 0] | Branch (4161:42): [True: 6.80k, False: 0] ------------------ 4162| 6.80k| { 4163| 6.80k| if (pp->read_filter[0] == NULL) ------------------ | Branch (4163:11): [True: 816, False: 5.98k] ------------------ 4164| 816| png_init_filter_functions(pp); 4165| | 4166| 6.80k| pp->read_filter[filter-1](row_info, row, prev_row); 4167| 6.80k| } 4168| 6.80k|} OSS_FUZZ_png_read_IDAT_data: 4174| 10.9k|{ 4175| | /* Loop reading IDATs and decompressing the result into output[avail_out] */ 4176| 10.9k| png_ptr->zstream.next_out = output; 4177| 10.9k| png_ptr->zstream.avail_out = 0; /* safety: set below */ 4178| | 4179| 10.9k| if (output == NULL) ------------------ | Branch (4179:8): [True: 44, False: 10.9k] ------------------ 4180| 44| avail_out = 0; 4181| | 4182| 10.9k| do 4183| 115k| { 4184| 115k| int ret; 4185| 115k| png_byte tmpbuf[PNG_INFLATE_BUF_SIZE]; 4186| | 4187| 115k| if (png_ptr->zstream.avail_in == 0) ------------------ | Branch (4187:11): [True: 2.57k, False: 112k] ------------------ 4188| 2.57k| { 4189| 2.57k| uInt avail_in; 4190| 2.57k| png_bytep buffer; 4191| | 4192| 3.57k| while (png_ptr->idat_size == 0) ------------------ | Branch (4192:17): [True: 1.00k, False: 2.56k] ------------------ 4193| 1.00k| { 4194| 1.00k| png_crc_finish(png_ptr, 0); ------------------ | | 25| 1.00k|#define png_crc_finish OSS_FUZZ_png_crc_finish ------------------ 4195| | 4196| 1.00k| png_ptr->idat_size = png_read_chunk_header(png_ptr); ------------------ | | 22| 1.00k|#define png_read_chunk_header OSS_FUZZ_png_read_chunk_header ------------------ 4197| | /* This is an error even in the 'check' case because the code just 4198| | * consumed a non-IDAT header. 4199| | */ 4200| 1.00k| if (png_ptr->chunk_name != png_IDAT) ------------------ | | 886| 1.00k|#define png_IDAT PNG_U32( 73, 68, 65, 84) | | ------------------ | | | | 845| 1.00k| (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0)) | | | | ------------------ | | | | | | 843| 1.00k|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s)) | | | | ------------------ | | | | (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0)) | | | | ------------------ | | | | | | 843| 1.00k|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s)) | | | | ------------------ | | | | (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0)) | | | | ------------------ | | | | | | 843| 1.00k|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s)) | | | | ------------------ | | | | (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0)) | | | | ------------------ | | | | | | 843| 1.00k|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s)) | | | | ------------------ | | ------------------ ------------------ | Branch (4200:17): [True: 1, False: 1.00k] ------------------ 4201| 1| png_error(png_ptr, "Not enough image data"); ------------------ | | 252| 1|#define png_error OSS_FUZZ_png_error ------------------ 4202| 1.00k| } 4203| | 4204| 2.56k| avail_in = png_ptr->IDAT_read_size; 4205| | 4206| 2.56k| if (avail_in > png_chunk_max(png_ptr)) ------------------ | | 1126| 2.56k|# define png_chunk_max(png_ptr) ((png_ptr)->user_chunk_malloc_max) ------------------ | Branch (4206:14): [True: 0, False: 2.56k] ------------------ 4207| 0| avail_in = (uInt)/*SAFE*/png_chunk_max(png_ptr); ------------------ | | 1126| 0|# define png_chunk_max(png_ptr) ((png_ptr)->user_chunk_malloc_max) ------------------ 4208| | 4209| 2.56k| if (avail_in > png_ptr->idat_size) ------------------ | Branch (4209:14): [True: 1.35k, False: 1.21k] ------------------ 4210| 1.35k| avail_in = (uInt)png_ptr->idat_size; 4211| | 4212| | /* A PNG with a gradually increasing IDAT size will defeat this attempt 4213| | * to minimize memory usage by causing lots of re-allocs, but 4214| | * realistically doing IDAT_read_size re-allocs is not likely to be a 4215| | * big problem. 4216| | * 4217| | * An error here corresponds to the system being out of memory. 4218| | */ 4219| 2.56k| buffer = png_read_buffer(png_ptr, avail_in); 4220| | 4221| 2.56k| if (buffer == NULL) ------------------ | Branch (4221:14): [True: 0, False: 2.56k] ------------------ 4222| 0| png_chunk_error(png_ptr, "out of memory"); ------------------ | | 239| 0|#define png_chunk_error OSS_FUZZ_png_chunk_error ------------------ 4223| | 4224| 2.56k| png_crc_read(png_ptr, buffer, avail_in); ------------------ | | 24| 2.56k|#define png_crc_read OSS_FUZZ_png_crc_read ------------------ 4225| 2.56k| png_ptr->idat_size -= avail_in; 4226| | 4227| 2.56k| png_ptr->zstream.next_in = buffer; 4228| 2.56k| png_ptr->zstream.avail_in = avail_in; 4229| 2.56k| } 4230| | 4231| | /* And set up the output side. */ 4232| 115k| if (output != NULL) /* standard read */ ------------------ | Branch (4232:11): [True: 10.3k, False: 105k] ------------------ 4233| 10.3k| { 4234| 10.3k| uInt out = ZLIB_IO_MAX; ------------------ | | 53| 10.3k|# define ZLIB_IO_MAX ((uInt)-1) ------------------ 4235| | 4236| 10.3k| if (out > avail_out) ------------------ | Branch (4236:14): [True: 10.3k, False: 0] ------------------ 4237| 10.3k| out = (uInt)avail_out; 4238| | 4239| 10.3k| avail_out -= out; 4240| 10.3k| png_ptr->zstream.avail_out = out; 4241| 10.3k| } 4242| | 4243| 105k| else /* after last row, checking for end */ 4244| 105k| { 4245| 105k| png_ptr->zstream.next_out = tmpbuf; 4246| 105k| png_ptr->zstream.avail_out = (sizeof tmpbuf); 4247| 105k| } 4248| | 4249| | /* Use NO_FLUSH; this gives zlib the maximum opportunity to optimize the 4250| | * process. If the LZ stream is truncated the sequential reader will 4251| | * terminally damage the stream, above, by reading the chunk header of the 4252| | * following chunk (it then exits with png_error). 4253| | * 4254| | * TODO: deal more elegantly with truncated IDAT lists. 4255| | */ 4256| 115k| ret = PNG_INFLATE(png_ptr, Z_NO_FLUSH); ------------------ | | 1729| 115k|# define PNG_INFLATE(pp, flush) png_zlib_inflate(pp, flush) | | ------------------ | | | | 42| 115k|#define png_zlib_inflate OSS_FUZZ_png_zlib_inflate | | ------------------ ------------------ 4257| | 4258| | /* Take the unconsumed output back. */ 4259| 115k| if (output != NULL) ------------------ | Branch (4259:11): [True: 10.3k, False: 105k] ------------------ 4260| 10.3k| avail_out += png_ptr->zstream.avail_out; 4261| | 4262| 105k| else /* avail_out counts the extra bytes */ 4263| 105k| avail_out += (sizeof tmpbuf) - png_ptr->zstream.avail_out; 4264| | 4265| 115k| png_ptr->zstream.avail_out = 0; 4266| | 4267| 115k| if (ret == Z_STREAM_END) ------------------ | Branch (4267:11): [True: 28, False: 115k] ------------------ 4268| 28| { 4269| | /* Do this for safety; we won't read any more into this row. */ 4270| 28| png_ptr->zstream.next_out = NULL; 4271| | 4272| 28| png_ptr->mode |= PNG_AFTER_IDAT; ------------------ | | 644| 28|#define PNG_AFTER_IDAT 0x08 ------------------ 4273| 28| png_ptr->flags |= PNG_FLAG_ZSTREAM_ENDED; ------------------ | | 698| 28|#define PNG_FLAG_ZSTREAM_ENDED 0x0008U /* Added to libpng-1.6.0 */ ------------------ 4274| | 4275| 28| if (png_ptr->zstream.avail_in > 0 || png_ptr->idat_size > 0) ------------------ | Branch (4275:14): [True: 15, False: 13] | Branch (4275:47): [True: 0, False: 13] ------------------ 4276| 15| png_chunk_benign_error(png_ptr, "Extra compressed data"); ------------------ | | 238| 15|#define png_chunk_benign_error OSS_FUZZ_png_chunk_benign_error ------------------ 4277| 28| break; 4278| 28| } 4279| | 4280| 115k| if (ret != Z_OK) ------------------ | Branch (4280:11): [True: 82, False: 115k] ------------------ 4281| 82| { 4282| 82| png_zstream_error(png_ptr, ret); ------------------ | | 4| 82|#define png_zstream_error OSS_FUZZ_png_zstream_error ------------------ 4283| | 4284| 82| if (output != NULL) ------------------ | Branch (4284:14): [True: 76, False: 6] ------------------ 4285| 76| png_chunk_error(png_ptr, png_ptr->zstream.msg); ------------------ | | 239| 76|#define png_chunk_error OSS_FUZZ_png_chunk_error ------------------ 4286| | 4287| 6| else /* checking */ 4288| 6| { 4289| 6| png_chunk_benign_error(png_ptr, png_ptr->zstream.msg); ------------------ | | 238| 6|#define png_chunk_benign_error OSS_FUZZ_png_chunk_benign_error ------------------ 4290| 6| return; 4291| 6| } 4292| 82| } 4293| 115k| } while (avail_out > 0); ------------------ | Branch (4293:13): [True: 104k, False: 10.8k] ------------------ 4294| | 4295| 10.8k| if (avail_out > 0) ------------------ | Branch (4295:8): [True: 14, False: 10.8k] ------------------ 4296| 14| { 4297| | /* The stream ended before the image; this is the same as too few IDATs so 4298| | * should be handled the same way. 4299| | */ 4300| 14| if (output != NULL) ------------------ | Branch (4300:11): [True: 13, False: 1] ------------------ 4301| 13| png_error(png_ptr, "Not enough image data"); ------------------ | | 252| 13|#define png_error OSS_FUZZ_png_error ------------------ 4302| | 4303| 1| else /* the deflate stream contained extra data */ 4304| 1| png_chunk_benign_error(png_ptr, "Too much image data"); ------------------ | | 238| 1|#define png_chunk_benign_error OSS_FUZZ_png_chunk_benign_error ------------------ 4305| 14| } 4306| 10.8k|} OSS_FUZZ_png_read_finish_IDAT: 4310| 56|{ 4311| | /* We don't need any more data and the stream should have ended, however the 4312| | * LZ end code may actually not have been processed. In this case we must 4313| | * read it otherwise stray unread IDAT data or, more likely, an IDAT chunk 4314| | * may still remain to be consumed. 4315| | */ 4316| 56| if ((png_ptr->flags & PNG_FLAG_ZSTREAM_ENDED) == 0) ------------------ | | 698| 56|#define PNG_FLAG_ZSTREAM_ENDED 0x0008U /* Added to libpng-1.6.0 */ ------------------ | Branch (4316:8): [True: 44, False: 12] ------------------ 4317| 44| { 4318| | /* The NULL causes png_read_IDAT_data to swallow any remaining bytes in 4319| | * the compressed stream, but the stream may be damaged too, so even after 4320| | * this call we may need to terminate the zstream ownership. 4321| | */ 4322| 44| png_read_IDAT_data(png_ptr, NULL, 0); ------------------ | | 38| 44|#define png_read_IDAT_data OSS_FUZZ_png_read_IDAT_data ------------------ 4323| 44| png_ptr->zstream.next_out = NULL; /* safety */ 4324| | 4325| | /* Now clear everything out for safety; the following may not have been 4326| | * done. 4327| | */ 4328| 44| if ((png_ptr->flags & PNG_FLAG_ZSTREAM_ENDED) == 0) ------------------ | | 698| 44|#define PNG_FLAG_ZSTREAM_ENDED 0x0008U /* Added to libpng-1.6.0 */ ------------------ | Branch (4328:11): [True: 6, False: 38] ------------------ 4329| 6| { 4330| 6| png_ptr->mode |= PNG_AFTER_IDAT; ------------------ | | 644| 6|#define PNG_AFTER_IDAT 0x08 ------------------ 4331| 6| png_ptr->flags |= PNG_FLAG_ZSTREAM_ENDED; ------------------ | | 698| 6|#define PNG_FLAG_ZSTREAM_ENDED 0x0008U /* Added to libpng-1.6.0 */ ------------------ 4332| 6| } 4333| 44| } 4334| | 4335| | /* If the zstream has not been released do it now *and* terminate the reading 4336| | * of the final IDAT chunk. 4337| | */ 4338| 56| if (png_ptr->zowner == png_IDAT) ------------------ | | 886| 56|#define png_IDAT PNG_U32( 73, 68, 65, 84) | | ------------------ | | | | 845| 56| (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0)) | | | | ------------------ | | | | | | 843| 56|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s)) | | | | ------------------ | | | | (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0)) | | | | ------------------ | | | | | | 843| 56|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s)) | | | | ------------------ | | | | (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0)) | | | | ------------------ | | | | | | 843| 56|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s)) | | | | ------------------ | | | | (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0)) | | | | ------------------ | | | | | | 843| 56|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s)) | | | | ------------------ | | ------------------ ------------------ | Branch (4338:8): [True: 19, False: 37] ------------------ 4339| 19| { 4340| | /* Always do this; the pointers otherwise point into the read buffer. */ 4341| 19| png_ptr->zstream.next_in = NULL; 4342| 19| png_ptr->zstream.avail_in = 0; 4343| | 4344| | /* Now we no longer own the zstream. */ 4345| 19| png_ptr->zowner = 0; 4346| | 4347| | /* The slightly weird semantics of the sequential IDAT reading is that we 4348| | * are always in or at the end of an IDAT chunk, so we always need to do a 4349| | * crc_finish here. If idat_size is non-zero we also need to read the 4350| | * spurious bytes at the end of the chunk now. 4351| | */ 4352| 19| (void)png_crc_finish(png_ptr, png_ptr->idat_size); ------------------ | | 25| 19|#define png_crc_finish OSS_FUZZ_png_crc_finish ------------------ 4353| 19| } 4354| 56|} OSS_FUZZ_png_read_finish_row: 4358| 9.77k|{ 4359| 9.77k| png_debug(1, "in png_read_finish_row"); ------------------ | | 145| 9.77k|# define png_debug(l, m) ((void)0) ------------------ 4360| 9.77k| png_ptr->row_number++; 4361| 9.77k| if (png_ptr->row_number < png_ptr->num_rows) ------------------ | Branch (4361:8): [True: 8.68k, False: 1.08k] ------------------ 4362| 8.68k| return; 4363| | 4364| 1.08k| if (png_ptr->interlaced != 0) ------------------ | Branch (4364:8): [True: 1.03k, False: 56] ------------------ 4365| 1.03k| { 4366| 1.03k| png_ptr->row_number = 0; 4367| | 4368| | /* TO DO: don't do this if prev_row isn't needed (requires 4369| | * read-ahead of the next row's filter byte. 4370| | */ 4371| 1.03k| memset(png_ptr->prev_row, 0, png_ptr->rowbytes + 1); 4372| | 4373| 1.03k| do 4374| 1.04k| { 4375| 1.04k| png_ptr->pass++; 4376| | 4377| 1.04k| if (png_ptr->pass >= 7) ------------------ | Branch (4377:14): [True: 0, False: 1.04k] ------------------ 4378| 0| break; 4379| | 4380| 1.04k| png_ptr->iwidth = (png_ptr->width + 4381| 1.04k| png_pass_inc[png_ptr->pass] - 1 - 4382| 1.04k| png_pass_start[png_ptr->pass]) / 4383| 1.04k| png_pass_inc[png_ptr->pass]; 4384| | 4385| 1.04k| if ((png_ptr->transformations & PNG_INTERLACE) == 0) ------------------ | | 659| 1.04k|#define PNG_INTERLACE 0x0002U ------------------ | Branch (4385:14): [True: 1.04k, False: 0] ------------------ 4386| 1.04k| { 4387| 1.04k| png_ptr->num_rows = (png_ptr->height + 4388| 1.04k| png_pass_yinc[png_ptr->pass] - 1 - 4389| 1.04k| png_pass_ystart[png_ptr->pass]) / 4390| 1.04k| png_pass_yinc[png_ptr->pass]; 4391| 1.04k| } 4392| | 4393| 0| else /* if (png_ptr->transformations & PNG_INTERLACE) */ 4394| 0| break; /* libpng deinterlacing sees every row */ 4395| | 4396| 1.04k| } while (png_ptr->num_rows == 0 || png_ptr->iwidth == 0); ------------------ | Branch (4396:16): [True: 1, False: 1.04k] | Branch (4396:42): [True: 15, False: 1.03k] ------------------ 4397| | 4398| 1.03k| if (png_ptr->pass < 7) ------------------ | Branch (4398:11): [True: 1.03k, False: 0] ------------------ 4399| 1.03k| return; 4400| 1.03k| } 4401| | 4402| | /* Here after at the end of the last row of the last pass. */ 4403| 56| png_read_finish_IDAT(png_ptr); ------------------ | | 39| 56|#define png_read_finish_IDAT OSS_FUZZ_png_read_finish_IDAT ------------------ 4404| 56|} OSS_FUZZ_png_read_start_row: 4409| 1.25k|{ 4410| 1.25k| unsigned int max_pixel_depth; 4411| 1.25k| size_t row_bytes; 4412| | 4413| 1.25k| png_debug(1, "in png_read_start_row"); ------------------ | | 145| 1.25k|# define png_debug(l, m) ((void)0) ------------------ 4414| | 4415| 1.25k|#ifdef PNG_READ_TRANSFORMS_SUPPORTED 4416| 1.25k| png_init_read_transformations(png_ptr); ------------------ | | 53| 1.25k|#define png_init_read_transformations OSS_FUZZ_png_init_read_transformations ------------------ 4417| 1.25k|#endif 4418| 1.25k| if (png_ptr->interlaced != 0) ------------------ | Branch (4418:8): [True: 815, False: 435] ------------------ 4419| 815| { 4420| 815| if ((png_ptr->transformations & PNG_INTERLACE) == 0) ------------------ | | 659| 815|#define PNG_INTERLACE 0x0002U ------------------ | Branch (4420:11): [True: 815, False: 0] ------------------ 4421| 815| png_ptr->num_rows = (png_ptr->height + png_pass_yinc[0] - 1 - 4422| 815| png_pass_ystart[0]) / png_pass_yinc[0]; 4423| | 4424| 0| else 4425| 0| png_ptr->num_rows = png_ptr->height; 4426| | 4427| 815| png_ptr->iwidth = (png_ptr->width + 4428| 815| png_pass_inc[png_ptr->pass] - 1 - 4429| 815| png_pass_start[png_ptr->pass]) / 4430| 815| png_pass_inc[png_ptr->pass]; 4431| 815| } 4432| | 4433| 435| else 4434| 435| { 4435| 435| png_ptr->num_rows = png_ptr->height; 4436| 435| png_ptr->iwidth = png_ptr->width; 4437| 435| } 4438| | 4439| 1.25k| max_pixel_depth = (unsigned int)png_ptr->pixel_depth; 4440| | 4441| | /* WARNING: * png_read_transform_info (pngrtran.c) performs a simpler set of 4442| | * calculations to calculate the final pixel depth, then 4443| | * png_do_read_transforms actually does the transforms. This means that the 4444| | * code which effectively calculates this value is actually repeated in three 4445| | * separate places. They must all match. Innocent changes to the order of 4446| | * transformations can and will break libpng in a way that causes memory 4447| | * overwrites. 4448| | * 4449| | * TODO: fix this. 4450| | */ 4451| 1.25k|#ifdef PNG_READ_PACK_SUPPORTED 4452| 1.25k| if ((png_ptr->transformations & PNG_PACK) != 0 && png_ptr->bit_depth < 8) ------------------ | | 660| 1.25k|#define PNG_PACK 0x0004U ------------------ | Branch (4452:8): [True: 334, False: 916] | Branch (4452:54): [True: 334, False: 0] ------------------ 4453| 334| max_pixel_depth = 8; 4454| 1.25k|#endif 4455| | 4456| 1.25k|#ifdef PNG_READ_EXPAND_SUPPORTED 4457| 1.25k| if ((png_ptr->transformations & PNG_EXPAND) != 0) ------------------ | | 670| 1.25k|#define PNG_EXPAND 0x1000U ------------------ | Branch (4457:8): [True: 0, False: 1.25k] ------------------ 4458| 0| { 4459| 0| if (png_ptr->color_type == PNG_COLOR_TYPE_PALETTE) ------------------ | | 667| 0|#define PNG_COLOR_TYPE_PALETTE (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_PALETTE) | | ------------------ | | | | 662| 0|#define PNG_COLOR_MASK_COLOR 2 | | ------------------ | | #define PNG_COLOR_TYPE_PALETTE (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_PALETTE) | | ------------------ | | | | 661| 0|#define PNG_COLOR_MASK_PALETTE 1 | | ------------------ ------------------ | Branch (4459:11): [True: 0, False: 0] ------------------ 4460| 0| { 4461| 0| if (png_ptr->num_trans != 0) ------------------ | Branch (4461:14): [True: 0, False: 0] ------------------ 4462| 0| max_pixel_depth = 32; 4463| | 4464| 0| else 4465| 0| max_pixel_depth = 24; 4466| 0| } 4467| | 4468| 0| else if (png_ptr->color_type == PNG_COLOR_TYPE_GRAY) ------------------ | | 666| 0|#define PNG_COLOR_TYPE_GRAY 0 ------------------ | Branch (4468:16): [True: 0, False: 0] ------------------ 4469| 0| { 4470| 0| if (max_pixel_depth < 8) ------------------ | Branch (4470:14): [True: 0, False: 0] ------------------ 4471| 0| max_pixel_depth = 8; 4472| | 4473| 0| if (png_ptr->num_trans != 0) ------------------ | Branch (4473:14): [True: 0, False: 0] ------------------ 4474| 0| max_pixel_depth *= 2; 4475| 0| } 4476| | 4477| 0| else if (png_ptr->color_type == PNG_COLOR_TYPE_RGB) ------------------ | | 668| 0|#define PNG_COLOR_TYPE_RGB (PNG_COLOR_MASK_COLOR) | | ------------------ | | | | 662| 0|#define PNG_COLOR_MASK_COLOR 2 | | ------------------ ------------------ | Branch (4477:16): [True: 0, False: 0] ------------------ 4478| 0| { 4479| 0| if (png_ptr->num_trans != 0) ------------------ | Branch (4479:14): [True: 0, False: 0] ------------------ 4480| 0| { 4481| 0| max_pixel_depth *= 4; 4482| 0| max_pixel_depth /= 3; 4483| 0| } 4484| 0| } 4485| 0| } 4486| 1.25k|#endif 4487| | 4488| 1.25k|#ifdef PNG_READ_EXPAND_16_SUPPORTED 4489| 1.25k| if ((png_ptr->transformations & PNG_EXPAND_16) != 0) ------------------ | | 667| 1.25k|#define PNG_EXPAND_16 0x0200U /* Added to libpng 1.5.2 */ ------------------ | Branch (4489:8): [True: 0, False: 1.25k] ------------------ 4490| 0| { 4491| 0|# ifdef PNG_READ_EXPAND_SUPPORTED 4492| | /* In fact it is an error if it isn't supported, but checking is 4493| | * the safe way. 4494| | */ 4495| 0| if ((png_ptr->transformations & PNG_EXPAND) != 0) ------------------ | | 670| 0|#define PNG_EXPAND 0x1000U ------------------ | Branch (4495:11): [True: 0, False: 0] ------------------ 4496| 0| { 4497| 0| if (png_ptr->bit_depth < 16) ------------------ | Branch (4497:14): [True: 0, False: 0] ------------------ 4498| 0| max_pixel_depth *= 2; 4499| 0| } 4500| 0| else 4501| 0|# endif 4502| 0| png_ptr->transformations &= ~PNG_EXPAND_16; ------------------ | | 667| 0|#define PNG_EXPAND_16 0x0200U /* Added to libpng 1.5.2 */ ------------------ 4503| 0| } 4504| 1.25k|#endif 4505| | 4506| 1.25k|#ifdef PNG_READ_FILLER_SUPPORTED 4507| 1.25k| if ((png_ptr->transformations & (PNG_FILLER)) != 0) ------------------ | | 673| 1.25k|#define PNG_FILLER 0x8000U ------------------ | Branch (4507:8): [True: 0, False: 1.25k] ------------------ 4508| 0| { 4509| 0| if (png_ptr->color_type == PNG_COLOR_TYPE_GRAY) ------------------ | | 666| 0|#define PNG_COLOR_TYPE_GRAY 0 ------------------ | Branch (4509:11): [True: 0, False: 0] ------------------ 4510| 0| { 4511| 0| if (max_pixel_depth <= 8) ------------------ | Branch (4511:14): [True: 0, False: 0] ------------------ 4512| 0| max_pixel_depth = 16; 4513| | 4514| 0| else 4515| 0| max_pixel_depth = 32; 4516| 0| } 4517| | 4518| 0| else if (png_ptr->color_type == PNG_COLOR_TYPE_RGB || ------------------ | | 668| 0|#define PNG_COLOR_TYPE_RGB (PNG_COLOR_MASK_COLOR) | | ------------------ | | | | 662| 0|#define PNG_COLOR_MASK_COLOR 2 | | ------------------ ------------------ | Branch (4518:16): [True: 0, False: 0] ------------------ 4519| 0| png_ptr->color_type == PNG_COLOR_TYPE_PALETTE) ------------------ | | 667| 0|#define PNG_COLOR_TYPE_PALETTE (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_PALETTE) | | ------------------ | | | | 662| 0|#define PNG_COLOR_MASK_COLOR 2 | | ------------------ | | #define PNG_COLOR_TYPE_PALETTE (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_PALETTE) | | ------------------ | | | | 661| 0|#define PNG_COLOR_MASK_PALETTE 1 | | ------------------ ------------------ | Branch (4519:10): [True: 0, False: 0] ------------------ 4520| 0| { 4521| 0| if (max_pixel_depth <= 32) ------------------ | Branch (4521:14): [True: 0, False: 0] ------------------ 4522| 0| max_pixel_depth = 32; 4523| | 4524| 0| else 4525| 0| max_pixel_depth = 64; 4526| 0| } 4527| 0| } 4528| 1.25k|#endif 4529| | 4530| 1.25k|#ifdef PNG_READ_GRAY_TO_RGB_SUPPORTED 4531| 1.25k| if ((png_ptr->transformations & PNG_GRAY_TO_RGB) != 0) ------------------ | | 672| 1.25k|#define PNG_GRAY_TO_RGB 0x4000U ------------------ | Branch (4531:8): [True: 0, False: 1.25k] ------------------ 4532| 0| { 4533| 0| if ( 4534| 0|#ifdef PNG_READ_EXPAND_SUPPORTED 4535| 0| (png_ptr->num_trans != 0 && ------------------ | Branch (4535:12): [True: 0, False: 0] ------------------ 4536| 0| (png_ptr->transformations & PNG_EXPAND) != 0) || ------------------ | | 670| 0|#define PNG_EXPAND 0x1000U ------------------ | Branch (4536:11): [True: 0, False: 0] ------------------ 4537| 0|#endif 4538| 0|#ifdef PNG_READ_FILLER_SUPPORTED 4539| 0| (png_ptr->transformations & (PNG_FILLER)) != 0 || ------------------ | | 673| 0|#define PNG_FILLER 0x8000U ------------------ | Branch (4539:11): [True: 0, False: 0] ------------------ 4540| 0|#endif 4541| 0| png_ptr->color_type == PNG_COLOR_TYPE_GRAY_ALPHA) ------------------ | | 670| 0|#define PNG_COLOR_TYPE_GRAY_ALPHA (PNG_COLOR_MASK_ALPHA) | | ------------------ | | | | 663| 0|#define PNG_COLOR_MASK_ALPHA 4 | | ------------------ ------------------ | Branch (4541:11): [True: 0, False: 0] ------------------ 4542| 0| { 4543| 0| if (max_pixel_depth <= 16) ------------------ | Branch (4543:14): [True: 0, False: 0] ------------------ 4544| 0| max_pixel_depth = 32; 4545| | 4546| 0| else 4547| 0| max_pixel_depth = 64; 4548| 0| } 4549| | 4550| 0| else 4551| 0| { 4552| 0| if (max_pixel_depth <= 8) ------------------ | Branch (4552:14): [True: 0, False: 0] ------------------ 4553| 0| { 4554| 0| if (png_ptr->color_type == PNG_COLOR_TYPE_RGB_ALPHA) ------------------ | | 669| 0|#define PNG_COLOR_TYPE_RGB_ALPHA (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_ALPHA) | | ------------------ | | | | 662| 0|#define PNG_COLOR_MASK_COLOR 2 | | ------------------ | | #define PNG_COLOR_TYPE_RGB_ALPHA (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_ALPHA) | | ------------------ | | | | 663| 0|#define PNG_COLOR_MASK_ALPHA 4 | | ------------------ ------------------ | Branch (4554:17): [True: 0, False: 0] ------------------ 4555| 0| max_pixel_depth = 32; 4556| | 4557| 0| else 4558| 0| max_pixel_depth = 24; 4559| 0| } 4560| | 4561| 0| else if (png_ptr->color_type == PNG_COLOR_TYPE_RGB_ALPHA) ------------------ | | 669| 0|#define PNG_COLOR_TYPE_RGB_ALPHA (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_ALPHA) | | ------------------ | | | | 662| 0|#define PNG_COLOR_MASK_COLOR 2 | | ------------------ | | #define PNG_COLOR_TYPE_RGB_ALPHA (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_ALPHA) | | ------------------ | | | | 663| 0|#define PNG_COLOR_MASK_ALPHA 4 | | ------------------ ------------------ | Branch (4561:19): [True: 0, False: 0] ------------------ 4562| 0| max_pixel_depth = 64; 4563| | 4564| 0| else 4565| 0| max_pixel_depth = 48; 4566| 0| } 4567| 0| } 4568| 1.25k|#endif 4569| | 4570| 1.25k|#if defined(PNG_READ_USER_TRANSFORM_SUPPORTED) && \ 4571| 1.25k|defined(PNG_USER_TRANSFORM_PTR_SUPPORTED) 4572| 1.25k| if ((png_ptr->transformations & PNG_USER_TRANSFORM) != 0) ------------------ | | 678| 1.25k|#define PNG_USER_TRANSFORM 0x100000U ------------------ | Branch (4572:8): [True: 0, False: 1.25k] ------------------ 4573| 0| { 4574| 0| unsigned int user_pixel_depth = png_ptr->user_transform_depth * 4575| 0| png_ptr->user_transform_channels; 4576| | 4577| 0| if (user_pixel_depth > max_pixel_depth) ------------------ | Branch (4577:11): [True: 0, False: 0] ------------------ 4578| 0| max_pixel_depth = user_pixel_depth; 4579| 0| } 4580| 1.25k|#endif 4581| | 4582| | /* This value is stored in png_struct and double checked in the row read 4583| | * code. 4584| | */ 4585| 1.25k| png_ptr->maximum_pixel_depth = (png_byte)max_pixel_depth; 4586| 1.25k| png_ptr->transformed_pixel_depth = 0; /* calculated on demand */ 4587| | 4588| | /* Align the width on the next larger 8 pixels. Mainly used 4589| | * for interlacing 4590| | */ 4591| 1.25k| row_bytes = ((png_ptr->width + 7) & ~((png_uint_32)7)); 4592| | /* Calculate the maximum bytes needed, adding a byte and a pixel 4593| | * for safety's sake 4594| | */ 4595| 1.25k| row_bytes = PNG_ROWBYTES(max_pixel_depth, row_bytes) + ------------------ | | 755| 1.25k| ((pixel_bits) >= 8 ? \ | | ------------------ | | | Branch (755:6): [True: 1.25k, False: 0] | | ------------------ | | 756| 1.25k| ((size_t)(width) * (((size_t)(pixel_bits)) >> 3)) : \ | | 757| 1.25k| (( ((size_t)(width) * ((size_t)(pixel_bits))) + 7) >> 3) ) ------------------ 4596| 1.25k| 1 + ((max_pixel_depth + 7) >> 3U); 4597| | 4598| |#ifdef PNG_MAX_MALLOC_64K 4599| | if (row_bytes > (png_uint_32)65536L) 4600| | png_error(png_ptr, "This image requires a row greater than 64KB"); 4601| |#endif 4602| | 4603| 1.25k| if (row_bytes + 48 > png_ptr->old_big_row_buf_size) ------------------ | Branch (4603:8): [True: 1.25k, False: 0] ------------------ 4604| 1.25k| { 4605| 1.25k| png_free(png_ptr, png_ptr->big_row_buf); ------------------ | | 253| 1.25k|#define png_free OSS_FUZZ_png_free ------------------ 4606| 1.25k| png_free(png_ptr, png_ptr->big_prev_row); ------------------ | | 253| 1.25k|#define png_free OSS_FUZZ_png_free ------------------ 4607| | 4608| 1.25k| if (png_ptr->interlaced != 0) ------------------ | Branch (4608:11): [True: 815, False: 435] ------------------ 4609| 815| png_ptr->big_row_buf = (png_bytep)png_calloc(png_ptr, ------------------ | | 237| 815|#define png_calloc OSS_FUZZ_png_calloc ------------------ 4610| 815| row_bytes + 48); 4611| | 4612| 435| else 4613| 435| png_ptr->big_row_buf = (png_bytep)png_malloc(png_ptr, row_bytes + 48); ------------------ | | 347| 435|#define png_malloc OSS_FUZZ_png_malloc ------------------ 4614| | 4615| 1.25k| png_ptr->big_prev_row = (png_bytep)png_malloc(png_ptr, row_bytes + 48); ------------------ | | 347| 1.25k|#define png_malloc OSS_FUZZ_png_malloc ------------------ 4616| | 4617| 1.25k|#ifdef PNG_ALIGNED_MEMORY_SUPPORTED 4618| | /* Use 16-byte aligned memory for row_buf with at least 16 bytes 4619| | * of padding before and after row_buf; treat prev_row similarly. 4620| | * NOTE: the alignment is to the start of the pixels, one beyond the start 4621| | * of the buffer, because of the filter byte. Prior to libpng 1.5.6 this 4622| | * was incorrect; the filter byte was aligned, which had the exact 4623| | * opposite effect of that intended. 4624| | */ 4625| 1.25k| { 4626| 1.25k| png_bytep temp = png_ptr->big_row_buf + 32; 4627| 1.25k| size_t extra = (size_t)temp & 0x0f; 4628| 1.25k| png_ptr->row_buf = temp - extra - 1/*filter byte*/; 4629| | 4630| 1.25k| temp = png_ptr->big_prev_row + 32; 4631| 1.25k| extra = (size_t)temp & 0x0f; 4632| 1.25k| png_ptr->prev_row = temp - extra - 1/*filter byte*/; 4633| 1.25k| } 4634| |#else 4635| | /* Use 31 bytes of padding before and 17 bytes after row_buf. */ 4636| | png_ptr->row_buf = png_ptr->big_row_buf + 31; 4637| | png_ptr->prev_row = png_ptr->big_prev_row + 31; 4638| |#endif 4639| 1.25k| png_ptr->old_big_row_buf_size = row_bytes + 48; 4640| 1.25k| } 4641| | 4642| |#ifdef PNG_MAX_MALLOC_64K 4643| | if (png_ptr->rowbytes > 65535) 4644| | png_error(png_ptr, "This image requires a row greater than 64KB"); 4645| | 4646| |#endif 4647| 1.25k| if (png_ptr->rowbytes > (PNG_SIZE_MAX - 1)) ------------------ | | 649| 1.25k|#define PNG_SIZE_MAX ((size_t)(-1)) ------------------ | Branch (4647:8): [True: 0, False: 1.25k] ------------------ 4648| 0| png_error(png_ptr, "Row has too many bytes to allocate in memory"); ------------------ | | 252| 0|#define png_error OSS_FUZZ_png_error ------------------ 4649| | 4650| 1.25k| memset(png_ptr->prev_row, 0, png_ptr->rowbytes + 1); 4651| | 4652| 1.25k| png_debug1(3, "width = %u,", png_ptr->width); ------------------ | | 148| 1.25k|# define png_debug1(l, m, p1) ((void)0) ------------------ 4653| 1.25k| png_debug1(3, "height = %u,", png_ptr->height); ------------------ | | 148| 1.25k|# define png_debug1(l, m, p1) ((void)0) ------------------ 4654| 1.25k| png_debug1(3, "iwidth = %u,", png_ptr->iwidth); ------------------ | | 148| 1.25k|# define png_debug1(l, m, p1) ((void)0) ------------------ 4655| 1.25k| png_debug1(3, "num_rows = %u,", png_ptr->num_rows); ------------------ | | 148| 1.25k|# define png_debug1(l, m, p1) ((void)0) ------------------ 4656| 1.25k| png_debug1(3, "rowbytes = %lu,", (unsigned long)png_ptr->rowbytes); ------------------ | | 148| 1.25k|# define png_debug1(l, m, p1) ((void)0) ------------------ 4657| 1.25k| png_debug1(3, "irowbytes = %lu", ------------------ | | 148| 1.25k|# define png_debug1(l, m, p1) ((void)0) ------------------ 4658| 1.25k| (unsigned long)PNG_ROWBYTES(png_ptr->pixel_depth, png_ptr->iwidth) + 1); 4659| | 4660| | /* The sequential reader needs a buffer for IDAT, but the progressive reader 4661| | * does not, so free the read buffer now regardless; the sequential reader 4662| | * reallocates it on demand. 4663| | */ 4664| 1.25k| if (png_ptr->read_buffer != NULL) ------------------ | Branch (4664:8): [True: 18, False: 1.23k] ------------------ 4665| 18| { 4666| 18| png_bytep buffer = png_ptr->read_buffer; 4667| | 4668| 18| png_ptr->read_buffer_size = 0; 4669| 18| png_ptr->read_buffer = NULL; 4670| 18| png_free(png_ptr, buffer); ------------------ | | 253| 18|#define png_free OSS_FUZZ_png_free ------------------ 4671| 18| } 4672| | 4673| | /* Finally claim the zstream for the inflate of the IDAT data, use the bits 4674| | * value from the stream (note that this will result in a fatal error if the 4675| | * IDAT stream has a bogus deflate header window_bits value, but this should 4676| | * not be happening any longer!) 4677| | */ 4678| 1.25k| if (png_inflate_claim(png_ptr, png_IDAT) != Z_OK) ------------------ | | 886| 1.25k|#define png_IDAT PNG_U32( 73, 68, 65, 84) | | ------------------ | | | | 845| 1.25k| (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0)) | | | | ------------------ | | | | | | 843| 1.25k|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s)) | | | | ------------------ | | | | (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0)) | | | | ------------------ | | | | | | 843| 1.25k|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s)) | | | | ------------------ | | | | (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0)) | | | | ------------------ | | | | | | 843| 1.25k|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s)) | | | | ------------------ | | | | (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0)) | | | | ------------------ | | | | | | 843| 1.25k|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s)) | | | | ------------------ | | ------------------ ------------------ | Branch (4678:8): [True: 0, False: 1.25k] ------------------ 4679| 0| png_error(png_ptr, png_ptr->zstream.msg); ------------------ | | 252| 0|#define png_error OSS_FUZZ_png_error ------------------ 4680| | 4681| 1.25k| png_ptr->flags |= PNG_FLAG_ROW_INIT; ------------------ | | 701| 1.25k|#define PNG_FLAG_ROW_INIT 0x0040U ------------------ 4682| 1.25k|} pngrutil.c:check_chunk_name: 154| 97.9k|{ 155| 97.9k| png_uint_32 t; 156| | 157| | /* Remove bit 5 from all but the reserved byte; this means 158| | * every 8-bit unit must be in the range 65-90 to be valid. 159| | * So bit 5 must be zero, bit 6 must be set and bit 7 zero. 160| | */ 161| 97.9k| name &= ~PNG_U32(32,32,0,32); ------------------ | | 845| 97.9k| (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0)) | | ------------------ | | | | 843| 97.9k|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s)) | | ------------------ | | (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0)) | | ------------------ | | | | 843| 97.9k|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s)) | | ------------------ | | (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0)) | | ------------------ | | | | 843| 97.9k|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s)) | | ------------------ | | (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0)) | | ------------------ | | | | 843| 97.9k|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s)) | | ------------------ ------------------ 162| 97.9k| t = (name & ~0x1f1f1f1fU) ^ 0x40404040U; 163| | 164| | /* Subtract 65 for each 8-bit quantity, this must not 165| | * overflow and each byte must then be in the range 0-25. 166| | */ 167| 97.9k| name -= PNG_U32(65,65,65,65); ------------------ | | 845| 97.9k| (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0)) | | ------------------ | | | | 843| 97.9k|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s)) | | ------------------ | | (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0)) | | ------------------ | | | | 843| 97.9k|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s)) | | ------------------ | | (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0)) | | ------------------ | | | | 843| 97.9k|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s)) | | ------------------ | | (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0)) | | ------------------ | | | | 843| 97.9k|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s)) | | ------------------ ------------------ 168| 97.9k| t |= name; 169| | 170| | /* Subtract 26, handling the overflow which should set the 171| | * top three bits of each byte. 172| | */ 173| 97.9k| name -= PNG_U32(25,25,25,26); ------------------ | | 845| 97.9k| (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0)) | | ------------------ | | | | 843| 97.9k|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s)) | | ------------------ | | (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0)) | | ------------------ | | | | 843| 97.9k|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s)) | | ------------------ | | (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0)) | | ------------------ | | | | 843| 97.9k|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s)) | | ------------------ | | (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0)) | | ------------------ | | | | 843| 97.9k|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s)) | | ------------------ ------------------ 174| 97.9k| t |= ~name; 175| | 176| 97.9k| return (t & 0xe0e0e0e0U) == 0U; 177| 97.9k|} pngrutil.c:png_crc_finish_critical: 314| 96.5k|{ 315| | /* The size of the local buffer for inflate is a good guess as to a 316| | * reasonable size to use for buffering reads from the application. 317| | */ 318| 115k| while (skip > 0) ------------------ | Branch (318:11): [True: 19.1k, False: 96.5k] ------------------ 319| 19.1k| { 320| 19.1k| png_uint_32 len; 321| 19.1k| png_byte tmpbuf[PNG_INFLATE_BUF_SIZE]; 322| | 323| 19.1k| len = (sizeof tmpbuf); 324| 19.1k| if (len > skip) ------------------ | Branch (324:11): [True: 16.8k, False: 2.25k] ------------------ 325| 16.8k| len = skip; 326| 19.1k| skip -= len; 327| | 328| 19.1k| png_crc_read(png_ptr, tmpbuf, len); ------------------ | | 24| 19.1k|#define png_crc_read OSS_FUZZ_png_crc_read ------------------ 329| 19.1k| } 330| | 331| | /* If 'handle_as_ancillary' has been requested and this is a critical chunk 332| | * but PNG_FLAG_CRC_CRITICAL_IGNORE was set then png_read_crc did not, in 333| | * fact, calculate the CRC so the ANCILLARY settings should not be used 334| | * instead. 335| | */ 336| 96.5k| if (handle_as_ancillary && ------------------ | Branch (336:8): [True: 1.13k, False: 95.3k] ------------------ 337| 1.13k| (png_ptr->flags & PNG_FLAG_CRC_CRITICAL_IGNORE) != 0) ------------------ | | 706| 1.13k|#define PNG_FLAG_CRC_CRITICAL_IGNORE 0x0800U ------------------ | Branch (337:8): [True: 0, False: 1.13k] ------------------ 338| 0| handle_as_ancillary = 0; 339| | 340| | /* TODO: this might be more comprehensible if png_crc_error was inlined here. 341| | */ 342| 96.5k| if (png_crc_error(png_ptr, handle_as_ancillary) != 0) ------------------ | Branch (342:8): [True: 47.7k, False: 48.7k] ------------------ 343| 47.7k| { 344| | /* See above for the explanation of how the flags work. */ 345| 47.7k| if (handle_as_ancillary || PNG_CHUNK_ANCILLARY(png_ptr->chunk_name) != 0 ? ------------------ | | 941| 46.6k|#define PNG_CHUNK_ANCILLARY(c) (1 & ((c) >> 29)) ------------------ | Branch (345:11): [True: 1.12k, False: 46.6k] | Branch (345:11): [True: 47.7k, False: 32] | Branch (345:34): [True: 46.6k, False: 32] ------------------ 346| 47.7k| (png_ptr->flags & PNG_FLAG_CRC_ANCILLARY_NOWARN) == 0 : ------------------ | | 704| 47.7k|#define PNG_FLAG_CRC_ANCILLARY_NOWARN 0x0200U ------------------ 347| 47.7k| (png_ptr->flags & PNG_FLAG_CRC_CRITICAL_USE) != 0) ------------------ | | 705| 32|#define PNG_FLAG_CRC_CRITICAL_USE 0x0400U ------------------ 348| 47.7k| png_chunk_warning(png_ptr, "CRC error"); ------------------ | | 240| 47.7k|#define png_chunk_warning OSS_FUZZ_png_chunk_warning ------------------ 349| | 350| 32| else 351| 32| png_chunk_error(png_ptr, "CRC error"); ------------------ | | 239| 32|#define png_chunk_error OSS_FUZZ_png_chunk_error ------------------ 352| | 353| 47.7k| return 1; 354| 47.7k| } 355| | 356| 48.7k| return 0; 357| 96.5k|} pngrutil.c:png_crc_error: 240| 93.9k|{ 241| 93.9k| png_byte crc_bytes[4]; 242| 93.9k| png_uint_32 crc; 243| 93.9k| int need_crc = 1; 244| | 245| | /* There are four flags two for ancillary and two for critical chunks. The 246| | * default setting of these flags is all zero. 247| | * 248| | * PNG_FLAG_CRC_ANCILLARY_USE 249| | * PNG_FLAG_CRC_ANCILLARY_NOWARN 250| | * USE+NOWARN: no CRC calculation (implemented here), else; 251| | * NOWARN: png_chunk_error on error (implemented in png_crc_finish) 252| | * else: png_chunk_warning on error (implemented in png_crc_finish) 253| | * This is the default. 254| | * 255| | * I.e. NOWARN without USE produces png_chunk_error. The default setting 256| | * where neither are set does the same thing. 257| | * 258| | * PNG_FLAG_CRC_CRITICAL_USE 259| | * PNG_FLAG_CRC_CRITICAL_IGNORE 260| | * IGNORE: no CRC calculation (implemented here), else; 261| | * USE: png_chunk_warning on error (implemented in png_crc_finish) 262| | * else: png_chunk_error on error (implemented in png_crc_finish) 263| | * This is the default. 264| | * 265| | * This arose because of original mis-implementation and has persisted for 266| | * compatibility reasons. 267| | * 268| | * TODO: the flag names are internal so maybe this can be changed to 269| | * something comprehensible. 270| | */ 271| 93.9k| if (handle_as_ancillary || PNG_CHUNK_ANCILLARY(png_ptr->chunk_name) != 0) ------------------ | | 941| 92.8k|#define PNG_CHUNK_ANCILLARY(c) (1 & ((c) >> 29)) ------------------ | Branch (271:8): [True: 1.13k, False: 92.8k] | Branch (271:31): [True: 86.3k, False: 6.50k] ------------------ 272| 87.4k| { 273| 87.4k| if ((png_ptr->flags & PNG_FLAG_CRC_ANCILLARY_MASK) == ------------------ | | 727| 87.4k|#define PNG_FLAG_CRC_ANCILLARY_MASK (PNG_FLAG_CRC_ANCILLARY_USE | \ | | ------------------ | | | | 703| 87.4k|#define PNG_FLAG_CRC_ANCILLARY_USE 0x0100U | | ------------------ | | 728| 87.4k| PNG_FLAG_CRC_ANCILLARY_NOWARN) | | ------------------ | | | | 704| 87.4k|#define PNG_FLAG_CRC_ANCILLARY_NOWARN 0x0200U | | ------------------ ------------------ | Branch (273:11): [True: 0, False: 87.4k] ------------------ 274| 87.4k| (PNG_FLAG_CRC_ANCILLARY_USE | PNG_FLAG_CRC_ANCILLARY_NOWARN)) ------------------ | | 703| 87.4k|#define PNG_FLAG_CRC_ANCILLARY_USE 0x0100U ------------------ (PNG_FLAG_CRC_ANCILLARY_USE | PNG_FLAG_CRC_ANCILLARY_NOWARN)) ------------------ | | 704| 87.4k|#define PNG_FLAG_CRC_ANCILLARY_NOWARN 0x0200U ------------------ 275| 0| need_crc = 0; 276| 87.4k| } 277| | 278| 6.50k| else /* critical */ 279| 6.50k| { 280| 6.50k| if ((png_ptr->flags & PNG_FLAG_CRC_CRITICAL_IGNORE) != 0) ------------------ | | 706| 6.50k|#define PNG_FLAG_CRC_CRITICAL_IGNORE 0x0800U ------------------ | Branch (280:11): [True: 0, False: 6.50k] ------------------ 281| 0| need_crc = 0; 282| 6.50k| } 283| | 284| 93.9k|#ifdef PNG_IO_STATE_SUPPORTED 285| 93.9k| png_ptr->io_state = PNG_IO_READING | PNG_IO_CHUNK_CRC; ------------------ | | 2664| 93.9k|# define PNG_IO_READING 0x0001 /* currently reading */ ------------------ png_ptr->io_state = PNG_IO_READING | PNG_IO_CHUNK_CRC; ------------------ | | 2669| 93.9k|# define PNG_IO_CHUNK_CRC 0x0080 /* currently at the chunk crc */ ------------------ 286| 93.9k|#endif 287| | 288| | /* The chunk CRC must be serialized in a single I/O call. */ 289| 93.9k| png_read_data(png_ptr, crc_bytes, 4); ------------------ | | 23| 93.9k|#define png_read_data OSS_FUZZ_png_read_data ------------------ 290| | 291| 93.9k| if (need_crc != 0) ------------------ | Branch (291:8): [True: 92.9k, False: 1.09k] ------------------ 292| 92.9k| { 293| 92.9k| crc = png_get_uint_32(crc_bytes); ------------------ | | 322| 92.9k|#define png_get_uint_32 OSS_FUZZ_png_get_uint_32 | | ------------------ | | | | 462| 92.9k|#define OSS_FUZZ_png_get_uint_32(buf) PNG_get_uint_32(buf) | | | | ------------------ | | | | | | 2823| 92.9k| (((png_uint_32)(*(buf)) << 24) + \ | | | | | | 2824| 92.9k| ((png_uint_32)(*((buf) + 1)) << 16) + \ | | | | | | 2825| 92.9k| ((png_uint_32)(*((buf) + 2)) << 8) + \ | | | | | | 2826| 92.9k| ((png_uint_32)(*((buf) + 3)))) | | | | ------------------ | | ------------------ ------------------ 294| 92.9k| return crc != png_ptr->crc; 295| 92.9k| } 296| | 297| 1.09k| else 298| 1.09k| return 0; 299| 93.9k|} pngrutil.c:png_chunk_index_from_name: 3088| 96.3k|{ 3089| | /* For chunk png_cHNK return PNG_INDEX_cHNK. Return PNG_INDEX_unknown if 3090| | * chunk_name is not known. Notice that in a particular build "known" does 3091| | * not necessarily mean "supported", although the inverse applies. 3092| | */ 3093| 96.3k| switch (chunk_name) 3094| 96.3k| { 3095| 0|# define PNG_CHUNK(cHNK, index)\ 3096| 0| case png_ ## cHNK: return PNG_INDEX_ ## cHNK; /* == index */ 3097| | 3098| 0| PNG_KNOWN_CHUNKS ------------------ | | 968| 5.36k| PNG_CHUNK(IHDR, 0)\ | | ------------------ | | | | 3096| 5.36k| case png_ ## cHNK: return PNG_INDEX_ ## cHNK; /* == index */ | | | | ------------------ | | | | | | 888| 5.36k|#define png_IHDR PNG_U32( 73, 72, 68, 82) | | | | | | ------------------ | | | | | | | | 845| 5.36k| (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0)) | | | | | | | | ------------------ | | | | | | | | | | 843| 5.36k|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s)) | | | | | | | | ------------------ | | | | | | | | (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0)) | | | | | | | | ------------------ | | | | | | | | | | 843| 5.36k|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s)) | | | | | | | | ------------------ | | | | | | | | (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0)) | | | | | | | | ------------------ | | | | | | | | | | 843| 5.36k|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s)) | | | | | | | | ------------------ | | | | | | | | (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0)) | | | | | | | | ------------------ | | | | | | | | | | 843| 5.36k|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s)) | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | | | | Branch (3096:10): [True: 5.36k, False: 91.0k] | | | | ------------------ | | ------------------ | | 969| 5.36k| PNG_CHUNK(PLTE, 1)\ | | ------------------ | | | | 3096| 1.36k| case png_ ## cHNK: return PNG_INDEX_ ## cHNK; /* == index */ | | | | ------------------ | | | | | | 889| 1.36k|#define png_PLTE PNG_U32( 80, 76, 84, 69) | | | | | | ------------------ | | | | | | | | 845| 1.36k| (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0)) | | | | | | | | ------------------ | | | | | | | | | | 843| 1.36k|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s)) | | | | | | | | ------------------ | | | | | | | | (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0)) | | | | | | | | ------------------ | | | | | | | | | | 843| 1.36k|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s)) | | | | | | | | ------------------ | | | | | | | | (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0)) | | | | | | | | ------------------ | | | | | | | | | | 843| 1.36k|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s)) | | | | | | | | ------------------ | | | | | | | | (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0)) | | | | | | | | ------------------ | | | | | | | | | | 843| 1.36k|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s)) | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | | | | Branch (3096:10): [True: 1.36k, False: 95.0k] | | | | ------------------ | | ------------------ | | 970| 1.36k| PNG_CHUNK(IDAT, 2)\ | | ------------------ | | | | 3096| 0| case png_ ## cHNK: return PNG_INDEX_ ## cHNK; /* == index */ | | | | ------------------ | | | | | | 886| 0|#define png_IDAT PNG_U32( 73, 68, 65, 84) | | | | | | ------------------ | | | | | | | | 845| 0| (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0)) | | | | | | | | ------------------ | | | | | | | | | | 843| 0|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s)) | | | | | | | | ------------------ | | | | | | | | (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0)) | | | | | | | | ------------------ | | | | | | | | | | 843| 0|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s)) | | | | | | | | ------------------ | | | | | | | | (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0)) | | | | | | | | ------------------ | | | | | | | | | | 843| 0|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s)) | | | | | | | | ------------------ | | | | | | | | (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0)) | | | | | | | | ------------------ | | | | | | | | | | 843| 0|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s)) | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | | | | Branch (3096:10): [True: 0, False: 96.3k] | | | | ------------------ | | ------------------ | | 971| 2| PNG_CHUNK(IEND, 3)\ | | ------------------ | | | | 3096| 2| case png_ ## cHNK: return PNG_INDEX_ ## cHNK; /* == index */ | | | | ------------------ | | | | | | 887| 2|#define png_IEND PNG_U32( 73, 69, 78, 68) | | | | | | ------------------ | | | | | | | | 845| 2| (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0)) | | | | | | | | ------------------ | | | | | | | | | | 843| 2|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s)) | | | | | | | | ------------------ | | | | | | | | (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0)) | | | | | | | | ------------------ | | | | | | | | | | 843| 2|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s)) | | | | | | | | ------------------ | | | | | | | | (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0)) | | | | | | | | ------------------ | | | | | | | | | | 843| 2|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s)) | | | | | | | | ------------------ | | | | | | | | (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0)) | | | | | | | | ------------------ | | | | | | | | | | 843| 2|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s)) | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | | | | Branch (3096:10): [True: 2, False: 96.3k] | | | | ------------------ | | ------------------ | | 972| 215| PNG_CHUNK(acTL, 4)\ | | ------------------ | | | | 3096| 215| case png_ ## cHNK: return PNG_INDEX_ ## cHNK; /* == index */ | | | | ------------------ | | | | | | 890| 215|#define png_acTL PNG_U32( 97, 99, 84, 76) /* PNGv3: APNG */ | | | | | | ------------------ | | | | | | | | 845| 215| (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0)) | | | | | | | | ------------------ | | | | | | | | | | 843| 215|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s)) | | | | | | | | ------------------ | | | | | | | | (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0)) | | | | | | | | ------------------ | | | | | | | | | | 843| 215|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s)) | | | | | | | | ------------------ | | | | | | | | (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0)) | | | | | | | | ------------------ | | | | | | | | | | 843| 215|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s)) | | | | | | | | ------------------ | | | | | | | | (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0)) | | | | | | | | ------------------ | | | | | | | | | | 843| 215|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s)) | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | | | | Branch (3096:10): [True: 215, False: 96.1k] | | | | ------------------ | | ------------------ | | 973| 2.76k| PNG_CHUNK(bKGD, 5)\ | | ------------------ | | | | 3096| 2.76k| case png_ ## cHNK: return PNG_INDEX_ ## cHNK; /* == index */ | | | | ------------------ | | | | | | 891| 2.76k|#define png_bKGD PNG_U32( 98, 75, 71, 68) | | | | | | ------------------ | | | | | | | | 845| 2.76k| (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0)) | | | | | | | | ------------------ | | | | | | | | | | 843| 2.76k|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s)) | | | | | | | | ------------------ | | | | | | | | (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0)) | | | | | | | | ------------------ | | | | | | | | | | 843| 2.76k|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s)) | | | | | | | | ------------------ | | | | | | | | (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0)) | | | | | | | | ------------------ | | | | | | | | | | 843| 2.76k|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s)) | | | | | | | | ------------------ | | | | | | | | (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0)) | | | | | | | | ------------------ | | | | | | | | | | 843| 2.76k|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s)) | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | | | | Branch (3096:10): [True: 2.76k, False: 93.6k] | | | | ------------------ | | ------------------ | | 974| 2.76k| PNG_CHUNK(cHRM, 6)\ | | ------------------ | | | | 3096| 1.35k| case png_ ## cHNK: return PNG_INDEX_ ## cHNK; /* == index */ | | | | ------------------ | | | | | | 892| 1.35k|#define png_cHRM PNG_U32( 99, 72, 82, 77) | | | | | | ------------------ | | | | | | | | 845| 1.35k| (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0)) | | | | | | | | ------------------ | | | | | | | | | | 843| 1.35k|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s)) | | | | | | | | ------------------ | | | | | | | | (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0)) | | | | | | | | ------------------ | | | | | | | | | | 843| 1.35k|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s)) | | | | | | | | ------------------ | | | | | | | | (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0)) | | | | | | | | ------------------ | | | | | | | | | | 843| 1.35k|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s)) | | | | | | | | ------------------ | | | | | | | | (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0)) | | | | | | | | ------------------ | | | | | | | | | | 843| 1.35k|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s)) | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | | | | Branch (3096:10): [True: 1.35k, False: 95.0k] | | | | ------------------ | | ------------------ | | 975| 1.35k| PNG_CHUNK(cICP, 7)\ | | ------------------ | | | | 3096| 242| case png_ ## cHNK: return PNG_INDEX_ ## cHNK; /* == index */ | | | | ------------------ | | | | | | 893| 242|#define png_cICP PNG_U32( 99, 73, 67, 80) /* PNGv3 */ | | | | | | ------------------ | | | | | | | | 845| 242| (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0)) | | | | | | | | ------------------ | | | | | | | | | | 843| 242|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s)) | | | | | | | | ------------------ | | | | | | | | (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0)) | | | | | | | | ------------------ | | | | | | | | | | 843| 242|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s)) | | | | | | | | ------------------ | | | | | | | | (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0)) | | | | | | | | ------------------ | | | | | | | | | | 843| 242|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s)) | | | | | | | | ------------------ | | | | | | | | (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0)) | | | | | | | | ------------------ | | | | | | | | | | 843| 242|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s)) | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | | | | Branch (3096:10): [True: 242, False: 96.1k] | | | | ------------------ | | ------------------ | | 976| 632| PNG_CHUNK(cLLI, 8)\ | | ------------------ | | | | 3096| 632| case png_ ## cHNK: return PNG_INDEX_ ## cHNK; /* == index */ | | | | ------------------ | | | | | | 894| 632|#define png_cLLI PNG_U32( 99, 76, 76, 73) /* PNGv3 */ | | | | | | ------------------ | | | | | | | | 845| 632| (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0)) | | | | | | | | ------------------ | | | | | | | | | | 843| 632|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s)) | | | | | | | | ------------------ | | | | | | | | (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0)) | | | | | | | | ------------------ | | | | | | | | | | 843| 632|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s)) | | | | | | | | ------------------ | | | | | | | | (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0)) | | | | | | | | ------------------ | | | | | | | | | | 843| 632|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s)) | | | | | | | | ------------------ | | | | | | | | (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0)) | | | | | | | | ------------------ | | | | | | | | | | 843| 632|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s)) | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | | | | Branch (3096:10): [True: 632, False: 95.7k] | | | | ------------------ | | ------------------ | | 977| 1.65k| PNG_CHUNK(eXIf, 9)\ | | ------------------ | | | | 3096| 1.65k| case png_ ## cHNK: return PNG_INDEX_ ## cHNK; /* == index */ | | | | ------------------ | | | | | | 895| 1.65k|#define png_eXIf PNG_U32(101, 88, 73, 102) /* registered July 2017 */ | | | | | | ------------------ | | | | | | | | 845| 1.65k| (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0)) | | | | | | | | ------------------ | | | | | | | | | | 843| 1.65k|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s)) | | | | | | | | ------------------ | | | | | | | | (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0)) | | | | | | | | ------------------ | | | | | | | | | | 843| 1.65k|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s)) | | | | | | | | ------------------ | | | | | | | | (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0)) | | | | | | | | ------------------ | | | | | | | | | | 843| 1.65k|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s)) | | | | | | | | ------------------ | | | | | | | | (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0)) | | | | | | | | ------------------ | | | | | | | | | | 843| 1.65k|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s)) | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | | | | Branch (3096:10): [True: 1.65k, False: 94.7k] | | | | ------------------ | | ------------------ | | 978| 1.65k| PNG_CHUNK(fcTL, 10)\ | | ------------------ | | | | 3096| 298| case png_ ## cHNK: return PNG_INDEX_ ## cHNK; /* == index */ | | | | ------------------ | | | | | | 896| 298|#define png_fcTL PNG_U32(102, 99, 84, 76) /* PNGv3: APNG */ | | | | | | ------------------ | | | | | | | | 845| 298| (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0)) | | | | | | | | ------------------ | | | | | | | | | | 843| 298|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s)) | | | | | | | | ------------------ | | | | | | | | (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0)) | | | | | | | | ------------------ | | | | | | | | | | 843| 298|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s)) | | | | | | | | ------------------ | | | | | | | | (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0)) | | | | | | | | ------------------ | | | | | | | | | | 843| 298|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s)) | | | | | | | | ------------------ | | | | | | | | (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0)) | | | | | | | | ------------------ | | | | | | | | | | 843| 298|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s)) | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | | | | Branch (3096:10): [True: 298, False: 96.0k] | | | | ------------------ | | ------------------ | | 979| 305| PNG_CHUNK(fdAT, 11)\ | | ------------------ | | | | 3096| 305| case png_ ## cHNK: return PNG_INDEX_ ## cHNK; /* == index */ | | | | ------------------ | | | | | | 897| 305|#define png_fdAT PNG_U32(102, 100, 65, 84) /* PNGv3: APNG */ | | | | | | ------------------ | | | | | | | | 845| 305| (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0)) | | | | | | | | ------------------ | | | | | | | | | | 843| 305|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s)) | | | | | | | | ------------------ | | | | | | | | (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0)) | | | | | | | | ------------------ | | | | | | | | | | 843| 305|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s)) | | | | | | | | ------------------ | | | | | | | | (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0)) | | | | | | | | ------------------ | | | | | | | | | | 843| 305|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s)) | | | | | | | | ------------------ | | | | | | | | (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0)) | | | | | | | | ------------------ | | | | | | | | | | 843| 305|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s)) | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | | | | Branch (3096:10): [True: 305, False: 96.0k] | | | | ------------------ | | ------------------ | | 980| 1.07k| PNG_CHUNK(gAMA, 12)\ | | ------------------ | | | | 3096| 1.07k| case png_ ## cHNK: return PNG_INDEX_ ## cHNK; /* == index */ | | | | ------------------ | | | | | | 899| 1.07k|#define png_gAMA PNG_U32(103, 65, 77, 65) | | | | | | ------------------ | | | | | | | | 845| 1.07k| (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0)) | | | | | | | | ------------------ | | | | | | | | | | 843| 1.07k|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s)) | | | | | | | | ------------------ | | | | | | | | (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0)) | | | | | | | | ------------------ | | | | | | | | | | 843| 1.07k|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s)) | | | | | | | | ------------------ | | | | | | | | (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0)) | | | | | | | | ------------------ | | | | | | | | | | 843| 1.07k|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s)) | | | | | | | | ------------------ | | | | | | | | (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0)) | | | | | | | | ------------------ | | | | | | | | | | 843| 1.07k|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s)) | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | | | | Branch (3096:10): [True: 1.07k, False: 95.3k] | | | | ------------------ | | ------------------ | | 981| 1.07k| PNG_CHUNK(hIST, 13)\ | | ------------------ | | | | 3096| 1.01k| case png_ ## cHNK: return PNG_INDEX_ ## cHNK; /* == index */ | | | | ------------------ | | | | | | 903| 1.01k|#define png_hIST PNG_U32(104, 73, 83, 84) | | | | | | ------------------ | | | | | | | | 845| 1.01k| (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0)) | | | | | | | | ------------------ | | | | | | | | | | 843| 1.01k|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s)) | | | | | | | | ------------------ | | | | | | | | (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0)) | | | | | | | | ------------------ | | | | | | | | | | 843| 1.01k|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s)) | | | | | | | | ------------------ | | | | | | | | (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0)) | | | | | | | | ------------------ | | | | | | | | | | 843| 1.01k|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s)) | | | | | | | | ------------------ | | | | | | | | (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0)) | | | | | | | | ------------------ | | | | | | | | | | 843| 1.01k|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s)) | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | | | | Branch (3096:10): [True: 1.01k, False: 95.3k] | | | | ------------------ | | ------------------ | | 982| 8.83k| PNG_CHUNK(iCCP, 14)\ | | ------------------ | | | | 3096| 8.83k| case png_ ## cHNK: return PNG_INDEX_ ## cHNK; /* == index */ | | | | ------------------ | | | | | | 904| 8.83k|#define png_iCCP PNG_U32(105, 67, 67, 80) | | | | | | ------------------ | | | | | | | | 845| 8.83k| (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0)) | | | | | | | | ------------------ | | | | | | | | | | 843| 8.83k|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s)) | | | | | | | | ------------------ | | | | | | | | (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0)) | | | | | | | | ------------------ | | | | | | | | | | 843| 8.83k|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s)) | | | | | | | | ------------------ | | | | | | | | (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0)) | | | | | | | | ------------------ | | | | | | | | | | 843| 8.83k|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s)) | | | | | | | | ------------------ | | | | | | | | (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0)) | | | | | | | | ------------------ | | | | | | | | | | 843| 8.83k|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s)) | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | | | | Branch (3096:10): [True: 8.83k, False: 87.5k] | | | | ------------------ | | ------------------ | | 983| 8.83k| PNG_CHUNK(iTXt, 15)\ | | ------------------ | | | | 3096| 4.62k| case png_ ## cHNK: return PNG_INDEX_ ## cHNK; /* == index */ | | | | ------------------ | | | | | | 905| 4.62k|#define png_iTXt PNG_U32(105, 84, 88, 116) | | | | | | ------------------ | | | | | | | | 845| 4.62k| (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0)) | | | | | | | | ------------------ | | | | | | | | | | 843| 4.62k|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s)) | | | | | | | | ------------------ | | | | | | | | (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0)) | | | | | | | | ------------------ | | | | | | | | | | 843| 4.62k|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s)) | | | | | | | | ------------------ | | | | | | | | (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0)) | | | | | | | | ------------------ | | | | | | | | | | 843| 4.62k|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s)) | | | | | | | | ------------------ | | | | | | | | (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0)) | | | | | | | | ------------------ | | | | | | | | | | 843| 4.62k|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s)) | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | | | | Branch (3096:10): [True: 4.62k, False: 91.7k] | | | | ------------------ | | ------------------ | | 984| 4.62k| PNG_CHUNK(mDCV, 16)\ | | ------------------ | | | | 3096| 838| case png_ ## cHNK: return PNG_INDEX_ ## cHNK; /* == index */ | | | | ------------------ | | | | | | 906| 838|#define png_mDCV PNG_U32(109, 68, 67, 86) /* PNGv3 */ | | | | | | ------------------ | | | | | | | | 845| 838| (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0)) | | | | | | | | ------------------ | | | | | | | | | | 843| 838|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s)) | | | | | | | | ------------------ | | | | | | | | (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0)) | | | | | | | | ------------------ | | | | | | | | | | 843| 838|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s)) | | | | | | | | ------------------ | | | | | | | | (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0)) | | | | | | | | ------------------ | | | | | | | | | | 843| 838|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s)) | | | | | | | | ------------------ | | | | | | | | (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0)) | | | | | | | | ------------------ | | | | | | | | | | 843| 838|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s)) | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | | | | Branch (3096:10): [True: 838, False: 95.5k] | | | | ------------------ | | ------------------ | | 985| 838| PNG_CHUNK(oFFs, 17)\ | | ------------------ | | | | 3096| 294| case png_ ## cHNK: return PNG_INDEX_ ## cHNK; /* == index */ | | | | ------------------ | | | | | | 907| 294|#define png_oFFs PNG_U32(111, 70, 70, 115) | | | | | | ------------------ | | | | | | | | 845| 294| (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0)) | | | | | | | | ------------------ | | | | | | | | | | 843| 294|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s)) | | | | | | | | ------------------ | | | | | | | | (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0)) | | | | | | | | ------------------ | | | | | | | | | | 843| 294|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s)) | | | | | | | | ------------------ | | | | | | | | (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0)) | | | | | | | | ------------------ | | | | | | | | | | 843| 294|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s)) | | | | | | | | ------------------ | | | | | | | | (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0)) | | | | | | | | ------------------ | | | | | | | | | | 843| 294|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s)) | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | | | | Branch (3096:10): [True: 294, False: 96.0k] | | | | ------------------ | | ------------------ | | 986| 2.53k| PNG_CHUNK(pCAL, 18)\ | | ------------------ | | | | 3096| 2.53k| case png_ ## cHNK: return PNG_INDEX_ ## cHNK; /* == index */ | | | | ------------------ | | | | | | 908| 2.53k|#define png_pCAL PNG_U32(112, 67, 65, 76) | | | | | | ------------------ | | | | | | | | 845| 2.53k| (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0)) | | | | | | | | ------------------ | | | | | | | | | | 843| 2.53k|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s)) | | | | | | | | ------------------ | | | | | | | | (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0)) | | | | | | | | ------------------ | | | | | | | | | | 843| 2.53k|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s)) | | | | | | | | ------------------ | | | | | | | | (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0)) | | | | | | | | ------------------ | | | | | | | | | | 843| 2.53k|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s)) | | | | | | | | ------------------ | | | | | | | | (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0)) | | | | | | | | ------------------ | | | | | | | | | | 843| 2.53k|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s)) | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | | | | Branch (3096:10): [True: 2.53k, False: 93.8k] | | | | ------------------ | | ------------------ | | 987| 2.53k| PNG_CHUNK(pHYs, 19)\ | | ------------------ | | | | 3096| 982| case png_ ## cHNK: return PNG_INDEX_ ## cHNK; /* == index */ | | | | ------------------ | | | | | | 909| 982|#define png_pHYs PNG_U32(112, 72, 89, 115) | | | | | | ------------------ | | | | | | | | 845| 982| (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0)) | | | | | | | | ------------------ | | | | | | | | | | 843| 982|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s)) | | | | | | | | ------------------ | | | | | | | | (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0)) | | | | | | | | ------------------ | | | | | | | | | | 843| 982|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s)) | | | | | | | | ------------------ | | | | | | | | (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0)) | | | | | | | | ------------------ | | | | | | | | | | 843| 982|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s)) | | | | | | | | ------------------ | | | | | | | | (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0)) | | | | | | | | ------------------ | | | | | | | | | | 843| 982|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s)) | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | | | | Branch (3096:10): [True: 982, False: 95.4k] | | | | ------------------ | | ------------------ | | 988| 1.00k| PNG_CHUNK(sBIT, 20)\ | | ------------------ | | | | 3096| 1.00k| case png_ ## cHNK: return PNG_INDEX_ ## cHNK; /* == index */ | | | | ------------------ | | | | | | 910| 1.00k|#define png_sBIT PNG_U32(115, 66, 73, 84) | | | | | | ------------------ | | | | | | | | 845| 1.00k| (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0)) | | | | | | | | ------------------ | | | | | | | | | | 843| 1.00k|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s)) | | | | | | | | ------------------ | | | | | | | | (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0)) | | | | | | | | ------------------ | | | | | | | | | | 843| 1.00k|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s)) | | | | | | | | ------------------ | | | | | | | | (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0)) | | | | | | | | ------------------ | | | | | | | | | | 843| 1.00k|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s)) | | | | | | | | ------------------ | | | | | | | | (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0)) | | | | | | | | ------------------ | | | | | | | | | | 843| 1.00k|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s)) | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | | | | Branch (3096:10): [True: 1.00k, False: 95.3k] | | | | ------------------ | | ------------------ | | 989| 3.82k| PNG_CHUNK(sCAL, 21)\ | | ------------------ | | | | 3096| 3.82k| case png_ ## cHNK: return PNG_INDEX_ ## cHNK; /* == index */ | | | | ------------------ | | | | | | 911| 3.82k|#define png_sCAL PNG_U32(115, 67, 65, 76) | | | | | | ------------------ | | | | | | | | 845| 3.82k| (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0)) | | | | | | | | ------------------ | | | | | | | | | | 843| 3.82k|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s)) | | | | | | | | ------------------ | | | | | | | | (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0)) | | | | | | | | ------------------ | | | | | | | | | | 843| 3.82k|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s)) | | | | | | | | ------------------ | | | | | | | | (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0)) | | | | | | | | ------------------ | | | | | | | | | | 843| 3.82k|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s)) | | | | | | | | ------------------ | | | | | | | | (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0)) | | | | | | | | ------------------ | | | | | | | | | | 843| 3.82k|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s)) | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | | | | Branch (3096:10): [True: 3.82k, False: 92.5k] | | | | ------------------ | | ------------------ | | 990| 16.3k| PNG_CHUNK(sPLT, 22)\ | | ------------------ | | | | 3096| 16.3k| case png_ ## cHNK: return PNG_INDEX_ ## cHNK; /* == index */ | | | | ------------------ | | | | | | 912| 16.3k|#define png_sPLT PNG_U32(115, 80, 76, 84) | | | | | | ------------------ | | | | | | | | 845| 16.3k| (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0)) | | | | | | | | ------------------ | | | | | | | | | | 843| 16.3k|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s)) | | | | | | | | ------------------ | | | | | | | | (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0)) | | | | | | | | ------------------ | | | | | | | | | | 843| 16.3k|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s)) | | | | | | | | ------------------ | | | | | | | | (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0)) | | | | | | | | ------------------ | | | | | | | | | | 843| 16.3k|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s)) | | | | | | | | ------------------ | | | | | | | | (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0)) | | | | | | | | ------------------ | | | | | | | | | | 843| 16.3k|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s)) | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | | | | Branch (3096:10): [True: 16.3k, False: 80.0k] | | | | ------------------ | | ------------------ | | 991| 16.3k| PNG_CHUNK(sRGB, 23)\ | | ------------------ | | | | 3096| 2.26k| case png_ ## cHNK: return PNG_INDEX_ ## cHNK; /* == index */ | | | | ------------------ | | | | | | 913| 2.26k|#define png_sRGB PNG_U32(115, 82, 71, 66) | | | | | | ------------------ | | | | | | | | 845| 2.26k| (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0)) | | | | | | | | ------------------ | | | | | | | | | | 843| 2.26k|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s)) | | | | | | | | ------------------ | | | | | | | | (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0)) | | | | | | | | ------------------ | | | | | | | | | | 843| 2.26k|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s)) | | | | | | | | ------------------ | | | | | | | | (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0)) | | | | | | | | ------------------ | | | | | | | | | | 843| 2.26k|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s)) | | | | | | | | ------------------ | | | | | | | | (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0)) | | | | | | | | ------------------ | | | | | | | | | | 843| 2.26k|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s)) | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | | | | Branch (3096:10): [True: 2.26k, False: 94.1k] | | | | ------------------ | | ------------------ | | 992| 27.7k| PNG_CHUNK(tEXt, 24)\ | | ------------------ | | | | 3096| 27.7k| case png_ ## cHNK: return PNG_INDEX_ ## cHNK; /* == index */ | | | | ------------------ | | | | | | 915| 27.7k|#define png_tEXt PNG_U32(116, 69, 88, 116) | | | | | | ------------------ | | | | | | | | 845| 27.7k| (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0)) | | | | | | | | ------------------ | | | | | | | | | | 843| 27.7k|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s)) | | | | | | | | ------------------ | | | | | | | | (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0)) | | | | | | | | ------------------ | | | | | | | | | | 843| 27.7k|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s)) | | | | | | | | ------------------ | | | | | | | | (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0)) | | | | | | | | ------------------ | | | | | | | | | | 843| 27.7k|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s)) | | | | | | | | ------------------ | | | | | | | | (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0)) | | | | | | | | ------------------ | | | | | | | | | | 843| 27.7k|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s)) | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | | | | Branch (3096:10): [True: 27.7k, False: 68.6k] | | | | ------------------ | | ------------------ | | 993| 27.7k| PNG_CHUNK(tIME, 25)\ | | ------------------ | | | | 3096| 461| case png_ ## cHNK: return PNG_INDEX_ ## cHNK; /* == index */ | | | | ------------------ | | | | | | 916| 461|#define png_tIME PNG_U32(116, 73, 77, 69) | | | | | | ------------------ | | | | | | | | 845| 461| (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0)) | | | | | | | | ------------------ | | | | | | | | | | 843| 461|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s)) | | | | | | | | ------------------ | | | | | | | | (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0)) | | | | | | | | ------------------ | | | | | | | | | | 843| 461|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s)) | | | | | | | | ------------------ | | | | | | | | (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0)) | | | | | | | | ------------------ | | | | | | | | | | 843| 461|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s)) | | | | | | | | ------------------ | | | | | | | | (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0)) | | | | | | | | ------------------ | | | | | | | | | | 843| 461|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s)) | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | | | | Branch (3096:10): [True: 461, False: 95.9k] | | | | ------------------ | | ------------------ | | 994| 4.25k| PNG_CHUNK(tRNS, 26)\ | | ------------------ | | | | 3096| 4.25k| case png_ ## cHNK: return PNG_INDEX_ ## cHNK; /* == index */ | | | | ------------------ | | | | | | 917| 4.25k|#define png_tRNS PNG_U32(116, 82, 78, 83) | | | | | | ------------------ | | | | | | | | 845| 4.25k| (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0)) | | | | | | | | ------------------ | | | | | | | | | | 843| 4.25k|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s)) | | | | | | | | ------------------ | | | | | | | | (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0)) | | | | | | | | ------------------ | | | | | | | | | | 843| 4.25k|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s)) | | | | | | | | ------------------ | | | | | | | | (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0)) | | | | | | | | ------------------ | | | | | | | | | | 843| 4.25k|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s)) | | | | | | | | ------------------ | | | | | | | | (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0)) | | | | | | | | ------------------ | | | | | | | | | | 843| 4.25k|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s)) | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | | | | Branch (3096:10): [True: 4.25k, False: 92.1k] | | | | ------------------ | | ------------------ | | 995| 4.25k| PNG_CHUNK(zTXt, 27) | | ------------------ | | | | 3096| 2.56k| case png_ ## cHNK: return PNG_INDEX_ ## cHNK; /* == index */ | | | | ------------------ | | | | | | 918| 2.56k|#define png_zTXt PNG_U32(122, 84, 88, 116) | | | | | | ------------------ | | | | | | | | 845| 2.56k| (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0)) | | | | | | | | ------------------ | | | | | | | | | | 843| 2.56k|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s)) | | | | | | | | ------------------ | | | | | | | | (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0)) | | | | | | | | ------------------ | | | | | | | | | | 843| 2.56k|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s)) | | | | | | | | ------------------ | | | | | | | | (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0)) | | | | | | | | ------------------ | | | | | | | | | | 843| 2.56k|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s)) | | | | | | | | ------------------ | | | | | | | | (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0)) | | | | | | | | ------------------ | | | | | | | | | | 843| 2.56k|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s)) | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | | | | Branch (3096:10): [True: 2.56k, False: 93.8k] | | | | ------------------ | | ------------------ ------------------ 3099| | 3100| 0|# undef PNG_CHUNK 3101| | 3102| 3.51k| default: return PNG_INDEX_unknown; ------------------ | Branch (3102:7): [True: 3.51k, False: 92.8k] ------------------ 3103| 96.3k| } 3104| 96.3k|} pngrutil.c:png_handle_IHDR: 902| 5.31k|{ 903| 5.31k| png_byte buf[13]; 904| 5.31k| png_uint_32 width, height; 905| 5.31k| int bit_depth, color_type, compression_type, filter_type; 906| 5.31k| int interlace_type; 907| | 908| 5.31k| png_debug(1, "in png_handle_IHDR"); ------------------ | | 145| 5.31k|# define png_debug(l, m) ((void)0) ------------------ 909| | 910| | /* Length and position are checked by the caller. */ 911| | 912| 5.31k| png_ptr->mode |= PNG_HAVE_IHDR; ------------------ | | 642| 5.31k|#define PNG_HAVE_IHDR 0x01 ------------------ 913| | 914| 5.31k| png_crc_read(png_ptr, buf, 13); ------------------ | | 24| 5.31k|#define png_crc_read OSS_FUZZ_png_crc_read ------------------ 915| 5.31k| png_crc_finish(png_ptr, 0); ------------------ | | 25| 5.31k|#define png_crc_finish OSS_FUZZ_png_crc_finish ------------------ 916| | 917| 5.31k| width = png_get_uint_31(png_ptr, buf); ------------------ | | 321| 5.31k|#define png_get_uint_31 OSS_FUZZ_png_get_uint_31 ------------------ 918| 5.31k| height = png_get_uint_31(png_ptr, buf + 4); ------------------ | | 321| 5.31k|#define png_get_uint_31 OSS_FUZZ_png_get_uint_31 ------------------ 919| 5.31k| bit_depth = buf[8]; 920| 5.31k| color_type = buf[9]; 921| 5.31k| compression_type = buf[10]; 922| 5.31k| filter_type = buf[11]; 923| 5.31k| interlace_type = buf[12]; 924| | 925| | /* Set internal variables */ 926| 5.31k| png_ptr->width = width; 927| 5.31k| png_ptr->height = height; 928| 5.31k| png_ptr->bit_depth = (png_byte)bit_depth; 929| 5.31k| png_ptr->interlaced = (png_byte)interlace_type; 930| 5.31k| png_ptr->color_type = (png_byte)color_type; 931| 5.31k|#ifdef PNG_MNG_FEATURES_SUPPORTED 932| 5.31k| png_ptr->filter_type = (png_byte)filter_type; 933| 5.31k|#endif 934| 5.31k| png_ptr->compression_type = (png_byte)compression_type; 935| | 936| | /* Find number of channels */ 937| 5.31k| switch (png_ptr->color_type) 938| 5.31k| { 939| 45| default: /* invalid, png_set_IHDR calls png_error */ ------------------ | Branch (939:7): [True: 45, False: 5.26k] ------------------ 940| 1.85k| case PNG_COLOR_TYPE_GRAY: ------------------ | | 666| 1.85k|#define PNG_COLOR_TYPE_GRAY 0 ------------------ | Branch (940:7): [True: 1.80k, False: 3.50k] ------------------ 941| 2.91k| case PNG_COLOR_TYPE_PALETTE: ------------------ | | 667| 2.91k|#define PNG_COLOR_TYPE_PALETTE (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_PALETTE) | | ------------------ | | | | 662| 2.91k|#define PNG_COLOR_MASK_COLOR 2 | | ------------------ | | #define PNG_COLOR_TYPE_PALETTE (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_PALETTE) | | ------------------ | | | | 661| 2.91k|#define PNG_COLOR_MASK_PALETTE 1 | | ------------------ ------------------ | Branch (941:7): [True: 1.06k, False: 4.24k] ------------------ 942| 2.91k| png_ptr->channels = 1; 943| 2.91k| break; 944| | 945| 1.32k| case PNG_COLOR_TYPE_RGB: ------------------ | | 668| 1.32k|#define PNG_COLOR_TYPE_RGB (PNG_COLOR_MASK_COLOR) | | ------------------ | | | | 662| 1.32k|#define PNG_COLOR_MASK_COLOR 2 | | ------------------ ------------------ | Branch (945:7): [True: 1.32k, False: 3.98k] ------------------ 946| 1.32k| png_ptr->channels = 3; 947| 1.32k| break; 948| | 949| 207| case PNG_COLOR_TYPE_GRAY_ALPHA: ------------------ | | 670| 207|#define PNG_COLOR_TYPE_GRAY_ALPHA (PNG_COLOR_MASK_ALPHA) | | ------------------ | | | | 663| 207|#define PNG_COLOR_MASK_ALPHA 4 | | ------------------ ------------------ | Branch (949:7): [True: 207, False: 5.10k] ------------------ 950| 207| png_ptr->channels = 2; 951| 207| break; 952| | 953| 833| case PNG_COLOR_TYPE_RGB_ALPHA: ------------------ | | 669| 833|#define PNG_COLOR_TYPE_RGB_ALPHA (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_ALPHA) | | ------------------ | | | | 662| 833|#define PNG_COLOR_MASK_COLOR 2 | | ------------------ | | #define PNG_COLOR_TYPE_RGB_ALPHA (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_ALPHA) | | ------------------ | | | | 663| 833|#define PNG_COLOR_MASK_ALPHA 4 | | ------------------ ------------------ | Branch (953:7): [True: 833, False: 4.47k] ------------------ 954| 833| png_ptr->channels = 4; 955| 833| break; 956| 5.31k| } 957| | 958| | /* Set up other useful info */ 959| 5.28k| png_ptr->pixel_depth = (png_byte)(png_ptr->bit_depth * png_ptr->channels); 960| 5.28k| png_ptr->rowbytes = PNG_ROWBYTES(png_ptr->pixel_depth, png_ptr->width); ------------------ | | 755| 5.28k| ((pixel_bits) >= 8 ? \ | | ------------------ | | | Branch (755:6): [True: 3.48k, False: 1.80k] | | ------------------ | | 756| 5.28k| ((size_t)(width) * (((size_t)(pixel_bits)) >> 3)) : \ | | 757| 5.28k| (( ((size_t)(width) * ((size_t)(pixel_bits))) + 7) >> 3) ) ------------------ 961| 5.28k| png_debug1(3, "bit_depth = %d", png_ptr->bit_depth); ------------------ | | 148| 5.28k|# define png_debug1(l, m, p1) ((void)0) ------------------ 962| 5.28k| png_debug1(3, "channels = %d", png_ptr->channels); ------------------ | | 148| 5.28k|# define png_debug1(l, m, p1) ((void)0) ------------------ 963| 5.28k| png_debug1(3, "rowbytes = %lu", (unsigned long)png_ptr->rowbytes); ------------------ | | 148| 5.28k|# define png_debug1(l, m, p1) ((void)0) ------------------ 964| | 965| | /* Rely on png_set_IHDR to completely validate the data and call png_error if 966| | * it's wrong. 967| | */ 968| 5.28k| png_set_IHDR(png_ptr, info_ptr, width, height, bit_depth, ------------------ | | 363| 5.28k|#define png_set_IHDR OSS_FUZZ_png_set_IHDR ------------------ 969| 5.28k| color_type, interlace_type, compression_type, filter_type); 970| | 971| 5.28k| return handled_ok; 972| 0| PNG_UNUSED(length) ------------------ | | 479| 0|# define PNG_UNUSED(param) (void)param; ------------------ 973| 0|} pngrutil.c:png_handle_PLTE: 982| 1.36k|{ 983| 1.36k| png_const_charp errmsg = NULL; 984| | 985| 1.36k| png_debug(1, "in png_handle_PLTE"); ------------------ | | 145| 1.36k|# define png_debug(l, m) ((void)0) ------------------ 986| | 987| | /* 1.6.47: consistency. This used to be especially treated as a critical 988| | * error even in an image which is not colour mapped, there isn't a good 989| | * justification for treating some errors here one way and others another so 990| | * everything uses the same logic. 991| | */ 992| 1.36k| if ((png_ptr->mode & PNG_HAVE_PLTE) != 0) ------------------ | | 643| 1.36k|#define PNG_HAVE_PLTE 0x02 ------------------ | Branch (992:8): [True: 205, False: 1.16k] ------------------ 993| 205| errmsg = "duplicate"; 994| | 995| 1.16k| else if ((png_ptr->mode & PNG_HAVE_IDAT) != 0) ------------------ | | 642| 1.16k|#define PNG_HAVE_IDAT 0x04U ------------------ | Branch (995:13): [True: 0, False: 1.16k] ------------------ 996| 0| errmsg = "out of place"; 997| | 998| 1.16k| else if ((png_ptr->color_type & PNG_COLOR_MASK_COLOR) == 0) ------------------ | | 662| 1.16k|#define PNG_COLOR_MASK_COLOR 2 ------------------ | Branch (998:13): [True: 214, False: 948] ------------------ 999| 214| errmsg = "ignored in grayscale PNG"; 1000| | 1001| 948| else if (length > 3*PNG_MAX_PALETTE_LENGTH || (length % 3) != 0) ------------------ | | 723| 1.89k|#define PNG_MAX_PALETTE_LENGTH 256 ------------------ | Branch (1001:13): [True: 40, False: 908] | Branch (1001:50): [True: 309, False: 599] ------------------ 1002| 349| errmsg = "invalid"; 1003| | 1004| | /* This drops PLTE in favour of tRNS or bKGD because both of those chunks 1005| | * can have an effect on the rendering of the image whereas PLTE only matters 1006| | * in the case of an 8-bit display with a decoder which controls the palette. 1007| | * 1008| | * The alternative here is to ignore the error and store the palette anyway; 1009| | * destroying the tRNS will definitely cause problems. 1010| | * 1011| | * NOTE: the case of PNG_COLOR_TYPE_PALETTE need not be considered because 1012| | * the png_handle_ routines for the three 'after PLTE' chunks tRNS, bKGD and 1013| | * hIST all check for a preceding PLTE in these cases. 1014| | */ 1015| 599| else if (png_ptr->color_type != PNG_COLOR_TYPE_PALETTE && ------------------ | | 667| 1.19k|#define PNG_COLOR_TYPE_PALETTE (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_PALETTE) | | ------------------ | | | | 662| 599|#define PNG_COLOR_MASK_COLOR 2 | | ------------------ | | #define PNG_COLOR_TYPE_PALETTE (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_PALETTE) | | ------------------ | | | | 661| 599|#define PNG_COLOR_MASK_PALETTE 1 | | ------------------ ------------------ | Branch (1015:13): [True: 434, False: 165] ------------------ 1016| 434| (png_has_chunk(png_ptr, tRNS) || png_has_chunk(png_ptr, bKGD))) ------------------ | | 194| 434| png_file_has_chunk(png_ptr, PNG_INDEX_ ## cHNK) | | ------------------ | | | | 115| 868| (((png_ptr)->chunks & png_chunk_flag_from_index(i)) != 0) | | | | ------------------ | | | | | | 108| 434|#define png_chunk_flag_from_index(i) (0x80000000U >> (31 - (i))) | | | | ------------------ | | | | | Branch (115:4): [True: 195, False: 239] | | | | ------------------ | | ------------------ ------------------ (png_has_chunk(png_ptr, tRNS) || png_has_chunk(png_ptr, bKGD))) ------------------ | | 194| 239| png_file_has_chunk(png_ptr, PNG_INDEX_ ## cHNK) | | ------------------ | | | | 115| 239| (((png_ptr)->chunks & png_chunk_flag_from_index(i)) != 0) | | | | ------------------ | | | | | | 108| 239|#define png_chunk_flag_from_index(i) (0x80000000U >> (31 - (i))) | | | | ------------------ | | | | | Branch (115:4): [True: 194, False: 45] | | | | ------------------ | | ------------------ ------------------ 1017| 389| errmsg = "out of place"; 1018| | 1019| 210| else 1020| 210| { 1021| | /* If the palette has 256 or fewer entries but is too large for the bit 1022| | * depth we don't issue an error to preserve the behavior of previous 1023| | * libpng versions. We silently truncate the unused extra palette entries 1024| | * here. 1025| | */ 1026| 210| const unsigned max_palette_length = 1027| 210| (png_ptr->color_type == PNG_COLOR_TYPE_PALETTE) ? ------------------ | | 667| 210|#define PNG_COLOR_TYPE_PALETTE (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_PALETTE) | | ------------------ | | | | 662| 210|#define PNG_COLOR_MASK_COLOR 2 | | ------------------ | | #define PNG_COLOR_TYPE_PALETTE (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_PALETTE) | | ------------------ | | | | 661| 210|#define PNG_COLOR_MASK_PALETTE 1 | | ------------------ ------------------ | Branch (1027:10): [True: 165, False: 45] ------------------ 1028| 165| 1U << png_ptr->bit_depth : PNG_MAX_PALETTE_LENGTH; ------------------ | | 723| 45|#define PNG_MAX_PALETTE_LENGTH 256 ------------------ 1029| | 1030| | /* The cast is safe because 'length' is less than 1031| | * 3*PNG_MAX_PALETTE_LENGTH 1032| | */ 1033| 210| const unsigned num = (length > 3U*max_palette_length) ? ------------------ | Branch (1033:28): [True: 12, False: 198] ------------------ 1034| 198| max_palette_length : (unsigned)length / 3U; 1035| | 1036| 210| unsigned i, j; 1037| 210| png_byte buf[3*PNG_MAX_PALETTE_LENGTH]; 1038| 210| png_color palette[PNG_MAX_PALETTE_LENGTH]; 1039| | 1040| | /* Read the chunk into the buffer then read to the end of the chunk. */ 1041| 210| png_crc_read(png_ptr, buf, num*3U); ------------------ | | 24| 210|#define png_crc_read OSS_FUZZ_png_crc_read ------------------ 1042| 210| png_crc_finish_critical(png_ptr, length - 3U*num, 1043| | /* Handle as ancillary if PLTE is optional: */ 1044| 210| png_ptr->color_type != PNG_COLOR_TYPE_PALETTE); ------------------ | | 667| 210|#define PNG_COLOR_TYPE_PALETTE (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_PALETTE) | | ------------------ | | | | 662| 210|#define PNG_COLOR_MASK_COLOR 2 | | ------------------ | | #define PNG_COLOR_TYPE_PALETTE (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_PALETTE) | | ------------------ | | | | 661| 210|#define PNG_COLOR_MASK_PALETTE 1 | | ------------------ ------------------ 1045| | 1046| 8.67k| for (i = 0U, j = 0U; i < num; i++) ------------------ | Branch (1046:28): [True: 8.46k, False: 210] ------------------ 1047| 8.46k| { 1048| 8.46k| palette[i].red = buf[j++]; 1049| 8.46k| palette[i].green = buf[j++]; 1050| 8.46k| palette[i].blue = buf[j++]; 1051| 8.46k| } 1052| | 1053| | /* A valid PLTE chunk has been read */ 1054| 210| png_ptr->mode |= PNG_HAVE_PLTE; ------------------ | | 643| 210|#define PNG_HAVE_PLTE 0x02 ------------------ 1055| | 1056| 210| png_set_PLTE(png_ptr, info_ptr, palette, num); ------------------ | | 364| 210|#define png_set_PLTE OSS_FUZZ_png_set_PLTE ------------------ 1057| 210| return handled_ok; 1058| 210| } 1059| | 1060| | /* Here on error: errmsg is non NULL. */ 1061| 1.15k| if (png_ptr->color_type == PNG_COLOR_TYPE_PALETTE) ------------------ | | 667| 1.15k|#define PNG_COLOR_TYPE_PALETTE (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_PALETTE) | | ------------------ | | | | 662| 1.15k|#define PNG_COLOR_MASK_COLOR 2 | | ------------------ | | #define PNG_COLOR_TYPE_PALETTE (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_PALETTE) | | ------------------ | | | | 661| 1.15k|#define PNG_COLOR_MASK_PALETTE 1 | | ------------------ ------------------ | Branch (1061:8): [True: 24, False: 1.13k] ------------------ 1062| 24| { 1063| 24| png_crc_finish(png_ptr, length); ------------------ | | 25| 24|#define png_crc_finish OSS_FUZZ_png_crc_finish ------------------ 1064| 24| png_chunk_error(png_ptr, errmsg); ------------------ | | 239| 48|#define png_chunk_error OSS_FUZZ_png_chunk_error ------------------ 1065| 24| } 1066| | 1067| 1.13k| else /* not critical to this image */ 1068| 1.13k| { 1069| 1.13k| png_crc_finish_critical(png_ptr, length, 1/*handle as ancillary*/); 1070| 1.13k| png_chunk_benign_error(png_ptr, errmsg); ------------------ | | 238| 1.13k|#define png_chunk_benign_error OSS_FUZZ_png_chunk_benign_error ------------------ 1071| 1.13k| } 1072| | 1073| | /* Because PNG_UNUSED(errmsg) does not work if all the uses are compiled out 1074| | * (this does happen). 1075| | */ 1076| 1.13k| return errmsg != NULL ? handled_error : handled_error; ------------------ | Branch (1076:11): [True: 1.08k, False: 51] ------------------ 1077| 1.15k|} pngrutil.c:png_handle_bKGD: 1773| 2.25k|{ 1774| 2.25k| unsigned int truelen; 1775| 2.25k| png_byte buf[6]; 1776| 2.25k| png_color_16 background; 1777| | 1778| 2.25k| png_debug(1, "in png_handle_bKGD"); ------------------ | | 145| 2.25k|# define png_debug(l, m) ((void)0) ------------------ 1779| | 1780| 2.25k| if (png_ptr->color_type == PNG_COLOR_TYPE_PALETTE) ------------------ | | 667| 2.25k|#define PNG_COLOR_TYPE_PALETTE (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_PALETTE) | | ------------------ | | | | 662| 2.25k|#define PNG_COLOR_MASK_COLOR 2 | | ------------------ | | #define PNG_COLOR_TYPE_PALETTE (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_PALETTE) | | ------------------ | | | | 661| 2.25k|#define PNG_COLOR_MASK_PALETTE 1 | | ------------------ ------------------ | Branch (1780:8): [True: 558, False: 1.69k] ------------------ 1781| 558| { 1782| 558| if ((png_ptr->mode & PNG_HAVE_PLTE) == 0) ------------------ | | 643| 558|#define PNG_HAVE_PLTE 0x02 ------------------ | Branch (1782:11): [True: 278, False: 280] ------------------ 1783| 278| { 1784| 278| png_crc_finish(png_ptr, length); ------------------ | | 25| 278|#define png_crc_finish OSS_FUZZ_png_crc_finish ------------------ 1785| 278| png_chunk_benign_error(png_ptr, "out of place"); ------------------ | | 238| 278|#define png_chunk_benign_error OSS_FUZZ_png_chunk_benign_error ------------------ 1786| 278| return handled_error; 1787| 278| } 1788| | 1789| 280| truelen = 1; 1790| 280| } 1791| | 1792| 1.69k| else if ((png_ptr->color_type & PNG_COLOR_MASK_COLOR) != 0) ------------------ | | 662| 1.69k|#define PNG_COLOR_MASK_COLOR 2 ------------------ | Branch (1792:13): [True: 991, False: 704] ------------------ 1793| 991| truelen = 6; 1794| | 1795| 704| else 1796| 704| truelen = 2; 1797| | 1798| 1.97k| if (length != truelen) ------------------ | Branch (1798:8): [True: 370, False: 1.60k] ------------------ 1799| 370| { 1800| 370| png_crc_finish(png_ptr, length); ------------------ | | 25| 370|#define png_crc_finish OSS_FUZZ_png_crc_finish ------------------ 1801| 370| png_chunk_benign_error(png_ptr, "invalid"); ------------------ | | 238| 370|#define png_chunk_benign_error OSS_FUZZ_png_chunk_benign_error ------------------ 1802| 370| return handled_error; 1803| 370| } 1804| | 1805| 1.60k| png_crc_read(png_ptr, buf, truelen); ------------------ | | 24| 1.60k|#define png_crc_read OSS_FUZZ_png_crc_read ------------------ 1806| | 1807| 1.60k| if (png_crc_finish(png_ptr, 0) != 0) ------------------ | | 25| 1.60k|#define png_crc_finish OSS_FUZZ_png_crc_finish ------------------ | Branch (1807:8): [True: 468, False: 1.13k] ------------------ 1808| 468| return handled_error; 1809| | 1810| | /* We convert the index value into RGB components so that we can allow 1811| | * arbitrary RGB values for background when we have transparency, and 1812| | * so it is easy to determine the RGB values of the background color 1813| | * from the info_ptr struct. 1814| | */ 1815| 1.13k| if (png_ptr->color_type == PNG_COLOR_TYPE_PALETTE) ------------------ | | 667| 1.13k|#define PNG_COLOR_TYPE_PALETTE (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_PALETTE) | | ------------------ | | | | 662| 1.13k|#define PNG_COLOR_MASK_COLOR 2 | | ------------------ | | #define PNG_COLOR_TYPE_PALETTE (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_PALETTE) | | ------------------ | | | | 661| 1.13k|#define PNG_COLOR_MASK_PALETTE 1 | | ------------------ ------------------ | Branch (1815:8): [True: 228, False: 909] ------------------ 1816| 228| { 1817| 228| background.index = buf[0]; 1818| | 1819| 228| if (info_ptr != NULL && info_ptr->num_palette != 0) ------------------ | Branch (1819:11): [True: 228, False: 0] | Branch (1819:31): [True: 228, False: 0] ------------------ 1820| 228| { 1821| 228| if (buf[0] >= info_ptr->num_palette) ------------------ | Branch (1821:14): [True: 224, False: 4] ------------------ 1822| 224| { 1823| 224| png_chunk_benign_error(png_ptr, "invalid index"); ------------------ | | 238| 224|#define png_chunk_benign_error OSS_FUZZ_png_chunk_benign_error ------------------ 1824| 224| return handled_error; 1825| 224| } 1826| | 1827| 4| background.red = (png_uint_16)png_ptr->palette[buf[0]].red; 1828| 4| background.green = (png_uint_16)png_ptr->palette[buf[0]].green; 1829| 4| background.blue = (png_uint_16)png_ptr->palette[buf[0]].blue; 1830| 4| } 1831| | 1832| 0| else 1833| 0| background.red = background.green = background.blue = 0; 1834| | 1835| 4| background.gray = 0; 1836| 4| } 1837| | 1838| 909| else if ((png_ptr->color_type & PNG_COLOR_MASK_COLOR) == 0) /* GRAY */ ------------------ | | 662| 909|#define PNG_COLOR_MASK_COLOR 2 ------------------ | Branch (1838:13): [True: 422, False: 487] ------------------ 1839| 422| { 1840| 422| if (png_ptr->bit_depth <= 8) ------------------ | Branch (1840:11): [True: 421, False: 1] ------------------ 1841| 421| { 1842| 421| if (buf[0] != 0 || buf[1] >= (unsigned int)(1 << png_ptr->bit_depth)) ------------------ | Branch (1842:14): [True: 223, False: 198] | Branch (1842:29): [True: 197, False: 1] ------------------ 1843| 420| { 1844| 420| png_chunk_benign_error(png_ptr, "invalid gray level"); ------------------ | | 238| 420|#define png_chunk_benign_error OSS_FUZZ_png_chunk_benign_error ------------------ 1845| 420| return handled_error; 1846| 420| } 1847| 421| } 1848| | 1849| 2| background.index = 0; 1850| 2| background.red = 1851| 2| background.green = 1852| 2| background.blue = 1853| 2| background.gray = png_get_uint_16(buf); ------------------ | | 320| 2|#define png_get_uint_16 OSS_FUZZ_png_get_uint_16 | | ------------------ | | | | 463| 2|#define OSS_FUZZ_png_get_uint_16(buf) PNG_get_uint_16(buf) | | | | ------------------ | | | | | | 2832| 2| ((png_uint_16) \ | | | | | | 2833| 2| (((unsigned int)(*(buf)) << 8) + \ | | | | | | 2834| 2| ((unsigned int)(*((buf) + 1))))) | | | | ------------------ | | ------------------ ------------------ 1854| 2| } 1855| | 1856| 487| else 1857| 487| { 1858| 487| if (png_ptr->bit_depth <= 8) ------------------ | Branch (1858:11): [True: 474, False: 13] ------------------ 1859| 474| { 1860| 474| if (buf[0] != 0 || buf[2] != 0 || buf[4] != 0) ------------------ | Branch (1860:14): [True: 71, False: 403] | Branch (1860:29): [True: 194, False: 209] | Branch (1860:44): [True: 198, False: 11] ------------------ 1861| 463| { 1862| 463| png_chunk_benign_error(png_ptr, "invalid color"); ------------------ | | 238| 463|#define png_chunk_benign_error OSS_FUZZ_png_chunk_benign_error ------------------ 1863| 463| return handled_error; 1864| 463| } 1865| 474| } 1866| | 1867| 24| background.index = 0; 1868| 24| background.red = png_get_uint_16(buf); ------------------ | | 320| 24|#define png_get_uint_16 OSS_FUZZ_png_get_uint_16 | | ------------------ | | | | 463| 24|#define OSS_FUZZ_png_get_uint_16(buf) PNG_get_uint_16(buf) | | | | ------------------ | | | | | | 2832| 24| ((png_uint_16) \ | | | | | | 2833| 24| (((unsigned int)(*(buf)) << 8) + \ | | | | | | 2834| 24| ((unsigned int)(*((buf) + 1))))) | | | | ------------------ | | ------------------ ------------------ 1869| 24| background.green = png_get_uint_16(buf + 2); ------------------ | | 320| 24|#define png_get_uint_16 OSS_FUZZ_png_get_uint_16 | | ------------------ | | | | 463| 24|#define OSS_FUZZ_png_get_uint_16(buf) PNG_get_uint_16(buf) | | | | ------------------ | | | | | | 2832| 24| ((png_uint_16) \ | | | | | | 2833| 24| (((unsigned int)(*(buf)) << 8) + \ | | | | | | 2834| 24| ((unsigned int)(*((buf) + 1))))) | | | | ------------------ | | ------------------ ------------------ 1870| 24| background.blue = png_get_uint_16(buf + 4); ------------------ | | 320| 24|#define png_get_uint_16 OSS_FUZZ_png_get_uint_16 | | ------------------ | | | | 463| 24|#define OSS_FUZZ_png_get_uint_16(buf) PNG_get_uint_16(buf) | | | | ------------------ | | | | | | 2832| 24| ((png_uint_16) \ | | | | | | 2833| 24| (((unsigned int)(*(buf)) << 8) + \ | | | | | | 2834| 24| ((unsigned int)(*((buf) + 1))))) | | | | ------------------ | | ------------------ ------------------ 1871| 24| background.gray = 0; 1872| 24| } 1873| | 1874| 30| png_set_bKGD(png_ptr, info_ptr, &background); ------------------ | | 368| 30|#define png_set_bKGD OSS_FUZZ_png_set_bKGD ------------------ 1875| 30| return handled_ok; 1876| 1.13k|} pngrutil.c:png_handle_cHRM: 1228| 922|{ 1229| 922| int error = 0; 1230| 922| png_xy xy; 1231| 922| png_byte buf[32]; 1232| | 1233| 922| png_debug(1, "in png_handle_cHRM"); ------------------ | | 145| 922|# define png_debug(l, m) ((void)0) ------------------ 1234| | 1235| 922| png_crc_read(png_ptr, buf, 32); ------------------ | | 24| 922|#define png_crc_read OSS_FUZZ_png_crc_read ------------------ 1236| | 1237| 922| if (png_crc_finish(png_ptr, 0) != 0) ------------------ | | 25| 922|#define png_crc_finish OSS_FUZZ_png_crc_finish ------------------ | Branch (1237:8): [True: 508, False: 414] ------------------ 1238| 508| return handled_error; 1239| | 1240| 414| xy.whitex = png_get_int_32_checked(buf + 0, &error); 1241| 414| xy.whitey = png_get_int_32_checked(buf + 4, &error); 1242| 414| xy.redx = png_get_int_32_checked(buf + 8, &error); 1243| 414| xy.redy = png_get_int_32_checked(buf + 12, &error); 1244| 414| xy.greenx = png_get_int_32_checked(buf + 16, &error); 1245| 414| xy.greeny = png_get_int_32_checked(buf + 20, &error); 1246| 414| xy.bluex = png_get_int_32_checked(buf + 24, &error); 1247| 414| xy.bluey = png_get_int_32_checked(buf + 28, &error); 1248| | 1249| 414| if (error) ------------------ | Branch (1249:8): [True: 316, False: 98] ------------------ 1250| 316| { 1251| 316| png_chunk_benign_error(png_ptr, "invalid"); ------------------ | | 238| 316|#define png_chunk_benign_error OSS_FUZZ_png_chunk_benign_error ------------------ 1252| 316| return handled_error; 1253| 316| } 1254| | 1255| | /* png_set_cHRM may complain about some of the values but this doesn't matter 1256| | * because it was a cHRM and it did have vaguely (if, perhaps, ridiculous) 1257| | * values. Ridiculosity will be checked if the values are used later. 1258| | */ 1259| 98| png_set_cHRM_fixed(png_ptr, info_ptr, xy.whitex, xy.whitey, xy.redx, xy.redy, ------------------ | | 376| 98|#define png_set_cHRM_fixed OSS_FUZZ_png_set_cHRM_fixed ------------------ 1260| 98| xy.greenx, xy.greeny, xy.bluex, xy.bluey); 1261| | 1262| | /* We only use 'chromaticities' for RGB to gray */ 1263| 98|# ifdef PNG_READ_RGB_TO_GRAY_SUPPORTED 1264| | /* There is no need to check sRGB here, cICP is NYI and iCCP is not 1265| | * supported so just check mDCV. 1266| | */ 1267| 98| if (!png_has_chunk(png_ptr, mDCV)) ------------------ | | 194| 98| png_file_has_chunk(png_ptr, PNG_INDEX_ ## cHNK) | | ------------------ | | | | 115| 98| (((png_ptr)->chunks & png_chunk_flag_from_index(i)) != 0) | | | | ------------------ | | | | | | 108| 98|#define png_chunk_flag_from_index(i) (0x80000000U >> (31 - (i))) | | | | ------------------ | | ------------------ ------------------ | Branch (1267:11): [True: 89, False: 9] ------------------ 1268| 89| { 1269| 89| png_ptr->chromaticities = xy; 1270| 89| } 1271| 98|# endif /* READ_RGB_TO_GRAY */ 1272| | 1273| 98| return handled_ok; 1274| 0| PNG_UNUSED(length) ------------------ | | 479| 0|# define PNG_UNUSED(param) (void)param; ------------------ 1275| 0|} pngrutil.c:png_get_int_32_checked: 1210| 3.24k|{ 1211| 3.24k| png_uint_32 uval = png_get_uint_32(buf); ------------------ | | 322| 3.24k|#define png_get_uint_32 OSS_FUZZ_png_get_uint_32 | | ------------------ | | | | 462| 3.24k|#define OSS_FUZZ_png_get_uint_32(buf) PNG_get_uint_32(buf) | | | | ------------------ | | | | | | 2823| 3.24k| (((png_uint_32)(*(buf)) << 24) + \ | | | | | | 2824| 3.24k| ((png_uint_32)(*((buf) + 1)) << 16) + \ | | | | | | 2825| 3.24k| ((png_uint_32)(*((buf) + 2)) << 8) + \ | | | | | | 2826| 3.24k| ((png_uint_32)(*((buf) + 3)))) | | | | ------------------ | | ------------------ ------------------ 1212| 3.24k| if ((uval & 0x80000000) == 0) /* non-negative */ ------------------ | Branch (1212:8): [True: 2.75k, False: 489] ------------------ 1213| 2.75k| return (png_int_32)uval; 1214| | 1215| 489| uval = (uval ^ 0xffffffff) + 1; /* 2's complement: -x = ~x+1 */ 1216| 489| if ((uval & 0x80000000) == 0) /* no overflow */ ------------------ | Branch (1216:8): [True: 173, False: 316] ------------------ 1217| 173| return -(png_int_32)uval; 1218| | 1219| | /* This version of png_get_int_32 has a way of returning the error to the 1220| | * caller, so: 1221| | */ 1222| 316| *error = 1; 1223| 316| return 0; /* Safe */ 1224| 489|} pngrutil.c:png_handle_cICP: 1884| 238|{ 1885| 238| png_byte buf[4]; 1886| | 1887| 238| png_debug(1, "in png_handle_cICP"); ------------------ | | 145| 238|# define png_debug(l, m) ((void)0) ------------------ 1888| | 1889| 238| png_crc_read(png_ptr, buf, 4); ------------------ | | 24| 238|#define png_crc_read OSS_FUZZ_png_crc_read ------------------ 1890| | 1891| 238| if (png_crc_finish(png_ptr, 0) != 0) ------------------ | | 25| 238|#define png_crc_finish OSS_FUZZ_png_crc_finish ------------------ | Branch (1891:8): [True: 227, False: 11] ------------------ 1892| 227| return handled_error; 1893| | 1894| 11| png_set_cICP(png_ptr, info_ptr, buf[0], buf[1], buf[2], buf[3]); ------------------ | | 377| 11|#define png_set_cICP OSS_FUZZ_png_set_cICP ------------------ 1895| | 1896| | /* We only use 'chromaticities' for RGB to gray */ 1897| 11|# ifdef PNG_READ_RGB_TO_GRAY_SUPPORTED 1898| 11| if (!png_has_chunk(png_ptr, mDCV)) ------------------ | | 194| 11| png_file_has_chunk(png_ptr, PNG_INDEX_ ## cHNK) | | ------------------ | | | | 115| 11| (((png_ptr)->chunks & png_chunk_flag_from_index(i)) != 0) | | | | ------------------ | | | | | | 108| 11|#define png_chunk_flag_from_index(i) (0x80000000U >> (31 - (i))) | | | | ------------------ | | ------------------ ------------------ | Branch (1898:11): [True: 6, False: 5] ------------------ 1899| 6| { 1900| | /* TODO: png_ptr->chromaticities = chromaticities; */ 1901| 6| } 1902| 11|# endif /* READ_RGB_TO_GRAY */ 1903| | 1904| 11|#ifdef PNG_READ_GAMMA_SUPPORTED 1905| | /* PNGv3: chunk precedence for gamma is cICP, [iCCP], sRGB, gAMA. cICP is 1906| | * at the head so simply set the gamma if it can be determined. If not 1907| | * chunk_gamma remains unchanged; sRGB and gAMA handling check it for 1908| | * being zero. 1909| | */ 1910| | /* TODO: set png_struct::chunk_gamma when possible */ 1911| 11|#endif /*READ_GAMMA*/ 1912| | 1913| 11| return handled_ok; 1914| 0| PNG_UNUSED(length) ------------------ | | 479| 0|# define PNG_UNUSED(param) (void)param; ------------------ 1915| 0|} pngrutil.c:png_handle_cLLI: 1923| 284|{ 1924| 284| png_byte buf[8]; 1925| | 1926| 284| png_debug(1, "in png_handle_cLLI"); ------------------ | | 145| 284|# define png_debug(l, m) ((void)0) ------------------ 1927| | 1928| 284| png_crc_read(png_ptr, buf, 8); ------------------ | | 24| 284|#define png_crc_read OSS_FUZZ_png_crc_read ------------------ 1929| | 1930| 284| if (png_crc_finish(png_ptr, 0) != 0) ------------------ | | 25| 284|#define png_crc_finish OSS_FUZZ_png_crc_finish ------------------ | Branch (1930:8): [True: 242, False: 42] ------------------ 1931| 242| return handled_error; 1932| | 1933| | /* The error checking happens here, this puts it in just one place: */ 1934| 42| png_set_cLLI_fixed(png_ptr, info_ptr, png_get_uint_32(buf), ------------------ | | 379| 42|#define png_set_cLLI_fixed OSS_FUZZ_png_set_cLLI_fixed ------------------ png_set_cLLI_fixed(png_ptr, info_ptr, png_get_uint_32(buf), ------------------ | | 322| 42|#define png_get_uint_32 OSS_FUZZ_png_get_uint_32 | | ------------------ | | | | 462| 42|#define OSS_FUZZ_png_get_uint_32(buf) PNG_get_uint_32(buf) | | | | ------------------ | | | | | | 2823| 42| (((png_uint_32)(*(buf)) << 24) + \ | | | | | | 2824| 42| ((png_uint_32)(*((buf) + 1)) << 16) + \ | | | | | | 2825| 42| ((png_uint_32)(*((buf) + 2)) << 8) + \ | | | | | | 2826| 42| ((png_uint_32)(*((buf) + 3)))) | | | | ------------------ | | ------------------ ------------------ 1935| 42| png_get_uint_32(buf+4)); ------------------ | | 322| 42|#define png_get_uint_32 OSS_FUZZ_png_get_uint_32 | | ------------------ | | | | 462| 42|#define OSS_FUZZ_png_get_uint_32(buf) PNG_get_uint_32(buf) | | | | ------------------ | | | | | | 2823| 42| (((png_uint_32)(*(buf)) << 24) + \ | | | | | | 2824| 42| ((png_uint_32)(*((buf) + 1)) << 16) + \ | | | | | | 2825| 42| ((png_uint_32)(*((buf) + 2)) << 8) + \ | | | | | | 2826| 42| ((png_uint_32)(*((buf) + 3)))) | | | | ------------------ | | ------------------ ------------------ 1936| 42| return handled_ok; 1937| 0| PNG_UNUSED(length) ------------------ | | 479| 0|# define PNG_UNUSED(param) (void)param; ------------------ 1938| 0|} pngrutil.c:png_handle_eXIf: 2000| 1.32k|{ 2001| 1.32k| png_bytep buffer = NULL; 2002| | 2003| 1.32k| png_debug(1, "in png_handle_eXIf"); ------------------ | | 145| 1.32k|# define png_debug(l, m) ((void)0) ------------------ 2004| | 2005| 1.32k| buffer = png_read_buffer(png_ptr, length); 2006| | 2007| 1.32k| if (buffer == NULL) ------------------ | Branch (2007:8): [True: 0, False: 1.32k] ------------------ 2008| 0| { 2009| 0| png_crc_finish(png_ptr, length); ------------------ | | 25| 0|#define png_crc_finish OSS_FUZZ_png_crc_finish ------------------ 2010| 0| png_chunk_benign_error(png_ptr, "out of memory"); ------------------ | | 238| 0|#define png_chunk_benign_error OSS_FUZZ_png_chunk_benign_error ------------------ 2011| 0| return handled_error; 2012| 0| } 2013| | 2014| 1.32k| png_crc_read(png_ptr, buffer, length); ------------------ | | 24| 1.32k|#define png_crc_read OSS_FUZZ_png_crc_read ------------------ 2015| | 2016| 1.32k| if (png_crc_finish(png_ptr, 0) != 0) ------------------ | | 25| 1.32k|#define png_crc_finish OSS_FUZZ_png_crc_finish ------------------ | Branch (2016:8): [True: 804, False: 521] ------------------ 2017| 804| return handled_error; 2018| | 2019| | /* PNGv3: the code used to check the byte order mark at the start for MM or 2020| | * II, however PNGv3 states that the first 4 bytes should be checked. 2021| | * The caller ensures that there are four bytes available. 2022| | */ 2023| 521| { 2024| 521| png_uint_32 header = png_get_uint_32(buffer); ------------------ | | 322| 521|#define png_get_uint_32 OSS_FUZZ_png_get_uint_32 | | ------------------ | | | | 462| 521|#define OSS_FUZZ_png_get_uint_32(buf) PNG_get_uint_32(buf) | | | | ------------------ | | | | | | 2823| 521| (((png_uint_32)(*(buf)) << 24) + \ | | | | | | 2824| 521| ((png_uint_32)(*((buf) + 1)) << 16) + \ | | | | | | 2825| 521| ((png_uint_32)(*((buf) + 2)) << 8) + \ | | | | | | 2826| 521| ((png_uint_32)(*((buf) + 3)))) | | | | ------------------ | | ------------------ ------------------ 2025| | 2026| | /* These numbers are copied from the PNGv3 spec: */ 2027| 521| if (header != 0x49492A00 && header != 0x4D4D002A) ------------------ | Branch (2027:11): [True: 429, False: 92] | Branch (2027:35): [True: 423, False: 6] ------------------ 2028| 423| { 2029| 423| png_chunk_benign_error(png_ptr, "invalid"); ------------------ | | 238| 423|#define png_chunk_benign_error OSS_FUZZ_png_chunk_benign_error ------------------ 2030| 423| return handled_error; 2031| 423| } 2032| 521| } 2033| | 2034| 98| png_set_eXIf_1(png_ptr, info_ptr, length, buffer); ------------------ | | 386| 98|#define png_set_eXIf_1 OSS_FUZZ_png_set_eXIf_1 ------------------ 2035| 98| return handled_ok; 2036| 521|} pngrutil.c:png_handle_gAMA: 1103| 617|{ 1104| 617| png_uint_32 ugamma; 1105| 617| png_byte buf[4]; 1106| | 1107| 617| png_debug(1, "in png_handle_gAMA"); ------------------ | | 145| 617|# define png_debug(l, m) ((void)0) ------------------ 1108| | 1109| 617| png_crc_read(png_ptr, buf, 4); ------------------ | | 24| 617|#define png_crc_read OSS_FUZZ_png_crc_read ------------------ 1110| | 1111| 617| if (png_crc_finish(png_ptr, 0) != 0) ------------------ | | 25| 617|#define png_crc_finish OSS_FUZZ_png_crc_finish ------------------ | Branch (1111:8): [True: 375, False: 242] ------------------ 1112| 375| return handled_error; 1113| | 1114| 242| ugamma = png_get_uint_32(buf); ------------------ | | 322| 242|#define png_get_uint_32 OSS_FUZZ_png_get_uint_32 | | ------------------ | | | | 462| 242|#define OSS_FUZZ_png_get_uint_32(buf) PNG_get_uint_32(buf) | | | | ------------------ | | | | | | 2823| 242| (((png_uint_32)(*(buf)) << 24) + \ | | | | | | 2824| 242| ((png_uint_32)(*((buf) + 1)) << 16) + \ | | | | | | 2825| 242| ((png_uint_32)(*((buf) + 2)) << 8) + \ | | | | | | 2826| 242| ((png_uint_32)(*((buf) + 3)))) | | | | ------------------ | | ------------------ ------------------ 1115| | 1116| 242| if (ugamma > PNG_UINT_31_MAX) ------------------ | | 647| 242|#define PNG_UINT_31_MAX ((png_uint_32)0x7fffffffL) ------------------ | Branch (1116:8): [True: 145, False: 97] ------------------ 1117| 145| { 1118| 145| png_chunk_benign_error(png_ptr, "invalid"); ------------------ | | 238| 145|#define png_chunk_benign_error OSS_FUZZ_png_chunk_benign_error ------------------ 1119| 145| return handled_error; 1120| 145| } 1121| | 1122| 97| png_set_gAMA_fixed(png_ptr, info_ptr, (png_fixed_point)/*SAFE*/ugamma); ------------------ | | 393| 97|#define png_set_gAMA_fixed OSS_FUZZ_png_set_gAMA_fixed ------------------ 1123| | 1124| 97|#ifdef PNG_READ_GAMMA_SUPPORTED 1125| | /* PNGv3: chunk precedence for gamma is cICP, [iCCP], sRGB, gAMA. gAMA is 1126| | * at the end of the chain so simply check for an unset value. 1127| | */ 1128| 97| if (png_ptr->chunk_gamma == 0) ------------------ | Branch (1128:11): [True: 87, False: 10] ------------------ 1129| 87| png_ptr->chunk_gamma = (png_fixed_point)/*SAFE*/ugamma; 1130| 97|#endif /*READ_GAMMA*/ 1131| | 1132| 97| return handled_ok; 1133| 0| PNG_UNUSED(length) ------------------ | | 479| 0|# define PNG_UNUSED(param) (void)param; ------------------ 1134| 0|} pngrutil.c:png_handle_hIST: 2044| 929|{ 2045| 929| unsigned int num, i; 2046| 929| png_uint_16 readbuf[PNG_MAX_PALETTE_LENGTH]; 2047| | 2048| 929| png_debug(1, "in png_handle_hIST"); ------------------ | | 145| 929|# define png_debug(l, m) ((void)0) ------------------ 2049| | 2050| | /* This cast is safe because the chunk definition limits the length to a 2051| | * maximum of 1024 bytes. 2052| | * 2053| | * TODO: maybe use png_uint_32 anyway, not unsigned int, to reduce the 2054| | * casts. 2055| | */ 2056| 929| num = (unsigned int)length / 2 ; 2057| | 2058| 929| if (length != num * 2 || ------------------ | Branch (2058:8): [True: 194, False: 735] ------------------ 2059| 735| num != (unsigned int)png_ptr->num_palette || ------------------ | Branch (2059:8): [True: 433, False: 302] ------------------ 2060| 302| num > (unsigned int)PNG_MAX_PALETTE_LENGTH) ------------------ | | 723| 302|#define PNG_MAX_PALETTE_LENGTH 256 ------------------ | Branch (2060:8): [True: 0, False: 302] ------------------ 2061| 627| { 2062| 627| png_crc_finish(png_ptr, length); ------------------ | | 25| 627|#define png_crc_finish OSS_FUZZ_png_crc_finish ------------------ 2063| 627| png_chunk_benign_error(png_ptr, "invalid"); ------------------ | | 238| 627|#define png_chunk_benign_error OSS_FUZZ_png_chunk_benign_error ------------------ 2064| 627| return handled_error; 2065| 627| } 2066| | 2067| 302| for (i = 0; i < num; i++) ------------------ | Branch (2067:16): [True: 0, False: 302] ------------------ 2068| 0| { 2069| 0| png_byte buf[2]; 2070| | 2071| 0| png_crc_read(png_ptr, buf, 2); ------------------ | | 24| 0|#define png_crc_read OSS_FUZZ_png_crc_read ------------------ 2072| 0| readbuf[i] = png_get_uint_16(buf); ------------------ | | 320| 0|#define png_get_uint_16 OSS_FUZZ_png_get_uint_16 | | ------------------ | | | | 463| 0|#define OSS_FUZZ_png_get_uint_16(buf) PNG_get_uint_16(buf) | | | | ------------------ | | | | | | 2832| 0| ((png_uint_16) \ | | | | | | 2833| 0| (((unsigned int)(*(buf)) << 8) + \ | | | | | | 2834| 0| ((unsigned int)(*((buf) + 1))))) | | | | ------------------ | | ------------------ ------------------ 2073| 0| } 2074| | 2075| 302| if (png_crc_finish(png_ptr, 0) != 0) ------------------ | | 25| 302|#define png_crc_finish OSS_FUZZ_png_crc_finish ------------------ | Branch (2075:8): [True: 292, False: 10] ------------------ 2076| 292| return handled_error; 2077| | 2078| 10| png_set_hIST(png_ptr, info_ptr, readbuf); ------------------ | | 397| 10|#define png_set_hIST OSS_FUZZ_png_set_hIST ------------------ 2079| 10| return handled_ok; 2080| 302|} pngrutil.c:png_handle_iCCP: 1329| 8.78k|{ 1330| 8.78k| png_const_charp errmsg = NULL; /* error message output, or no error */ 1331| 8.78k| int finished = 0; /* crc checked */ 1332| | 1333| 8.78k| png_debug(1, "in png_handle_iCCP"); ------------------ | | 145| 8.78k|# define png_debug(l, m) ((void)0) ------------------ 1334| | 1335| | /* PNGv3: allow PNG files with both sRGB and iCCP because the PNG spec only 1336| | * ever said that there "should" be only one, not "shall" and the PNGv3 1337| | * colour chunk precedence rules give a handling for this case anyway. 1338| | */ 1339| 8.78k| { 1340| 8.78k| uInt read_length, keyword_length; 1341| 8.78k| char keyword[81]; 1342| | 1343| | /* Find the keyword; the keyword plus separator and compression method 1344| | * bytes can be at most 81 characters long. 1345| | */ 1346| 8.78k| read_length = 81; /* maximum */ 1347| 8.78k| if (read_length > length) ------------------ | Branch (1347:11): [True: 251, False: 8.53k] ------------------ 1348| 251| read_length = (uInt)/*SAFE*/length; 1349| | 1350| 8.78k| png_crc_read(png_ptr, (png_bytep)keyword, read_length); ------------------ | | 24| 8.78k|#define png_crc_read OSS_FUZZ_png_crc_read ------------------ 1351| 8.78k| length -= read_length; 1352| | 1353| 8.78k| if (length < LZ77Min) ------------------ | | 23| 8.78k|#define LZ77Min (2U+5U+4U) ------------------ | Branch (1353:11): [True: 251, False: 8.53k] ------------------ 1354| 251| { 1355| 251| png_crc_finish(png_ptr, length); ------------------ | | 25| 251|#define png_crc_finish OSS_FUZZ_png_crc_finish ------------------ 1356| 251| png_chunk_benign_error(png_ptr, "too short"); ------------------ | | 238| 251|#define png_chunk_benign_error OSS_FUZZ_png_chunk_benign_error ------------------ 1357| 251| return handled_error; 1358| 251| } 1359| | 1360| 8.53k| keyword_length = 0; 1361| 106k| while (keyword_length < 80 && keyword_length < read_length && ------------------ | Branch (1361:14): [True: 106k, False: 244] | Branch (1361:37): [True: 106k, False: 0] ------------------ 1362| 106k| keyword[keyword_length] != 0) ------------------ | Branch (1362:10): [True: 98.3k, False: 8.29k] ------------------ 1363| 98.3k| ++keyword_length; 1364| | 1365| | /* TODO: make the keyword checking common */ 1366| 8.53k| if (keyword_length >= 1 && keyword_length <= 79) ------------------ | Branch (1366:11): [True: 8.39k, False: 144] | Branch (1366:34): [True: 8.19k, False: 197] ------------------ 1367| 8.19k| { 1368| | /* We only understand '0' compression - deflate - so if we get a 1369| | * different value we can't safely decode the chunk. 1370| | */ 1371| 8.19k| if (keyword_length+1 < read_length && ------------------ | Branch (1371:14): [True: 8.19k, False: 0] ------------------ 1372| 8.19k| keyword[keyword_length+1] == PNG_COMPRESSION_TYPE_BASE) ------------------ | | 676| 8.19k|#define PNG_COMPRESSION_TYPE_BASE 0 /* Deflate method 8, 32K window */ ------------------ | Branch (1372:13): [True: 7.89k, False: 301] ------------------ 1373| 7.89k| { 1374| 7.89k| read_length -= keyword_length+2; 1375| | 1376| 7.89k| if (png_inflate_claim(png_ptr, png_iCCP) == Z_OK) ------------------ | | 904| 7.89k|#define png_iCCP PNG_U32(105, 67, 67, 80) | | ------------------ | | | | 845| 7.89k| (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0)) | | | | ------------------ | | | | | | 843| 7.89k|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s)) | | | | ------------------ | | | | (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0)) | | | | ------------------ | | | | | | 843| 7.89k|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s)) | | | | ------------------ | | | | (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0)) | | | | ------------------ | | | | | | 843| 7.89k|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s)) | | | | ------------------ | | | | (PNG_32b(b1,24) | PNG_32b(b2,16) | PNG_32b(b3,8) | PNG_32b(b4,0)) | | | | ------------------ | | | | | | 843| 7.89k|#define PNG_32b(b,s) (((0xFFFFFFFFU)&(b)) << (s)) | | | | ------------------ | | ------------------ ------------------ | Branch (1376:17): [True: 7.89k, False: 0] ------------------ 1377| 7.89k| { 1378| 7.89k| Byte profile_header[132]={0}; 1379| 7.89k| Byte local_buffer[PNG_INFLATE_BUF_SIZE]; 1380| 7.89k| png_alloc_size_t size = (sizeof profile_header); 1381| | 1382| 7.89k| png_ptr->zstream.next_in = (Bytef*)keyword + (keyword_length+2); 1383| 7.89k| png_ptr->zstream.avail_in = read_length; 1384| 7.89k| (void)png_inflate_read(png_ptr, local_buffer, 1385| 7.89k| (sizeof local_buffer), &length, profile_header, &size, 1386| 7.89k| 0/*finish: don't, because the output is too small*/); 1387| | 1388| 7.89k| if (size == 0) ------------------ | Branch (1388:20): [True: 6.79k, False: 1.09k] ------------------ 1389| 6.79k| { 1390| | /* We have the ICC profile header; do the basic header checks. 1391| | */ 1392| 6.79k| png_uint_32 profile_length = png_get_uint_32(profile_header); ------------------ | | 322| 6.79k|#define png_get_uint_32 OSS_FUZZ_png_get_uint_32 | | ------------------ | | | | 462| 6.79k|#define OSS_FUZZ_png_get_uint_32(buf) PNG_get_uint_32(buf) | | | | ------------------ | | | | | | 2823| 6.79k| (((png_uint_32)(*(buf)) << 24) + \ | | | | | | 2824| 6.79k| ((png_uint_32)(*((buf) + 1)) << 16) + \ | | | | | | 2825| 6.79k| ((png_uint_32)(*((buf) + 2)) << 8) + \ | | | | | | 2826| 6.79k| ((png_uint_32)(*((buf) + 3)))) | | | | ------------------ | | ------------------ ------------------ 1393| | 1394| 6.79k| if (png_icc_check_length(png_ptr, keyword, profile_length) != ------------------ | | 68| 6.79k|#define png_icc_check_length OSS_FUZZ_png_icc_check_length ------------------ | Branch (1394:23): [True: 6.29k, False: 507] ------------------ 1395| 6.79k| 0) 1396| 6.29k| { 1397| | /* The length is apparently ok, so we can check the 132 1398| | * byte header. 1399| | */ 1400| 6.29k| if (png_icc_check_header(png_ptr, keyword, profile_length, ------------------ | | 69| 6.29k|#define png_icc_check_header OSS_FUZZ_png_icc_check_header ------------------ | Branch (1400:26): [True: 2.42k, False: 3.87k] ------------------ 1401| 6.29k| profile_header, png_ptr->color_type) != 0) 1402| 2.42k| { 1403| | /* Now read the tag table; a variable size buffer is 1404| | * needed at this point, allocate one for the whole 1405| | * profile. The header check has already validated 1406| | * that none of this stuff will overflow. 1407| | */ 1408| 2.42k| png_uint_32 tag_count = 1409| 2.42k| png_get_uint_32(profile_header + 128); ------------------ | | 322| 2.42k|#define png_get_uint_32 OSS_FUZZ_png_get_uint_32 | | ------------------ | | | | 462| 2.42k|#define OSS_FUZZ_png_get_uint_32(buf) PNG_get_uint_32(buf) | | | | ------------------ | | | | | | 2823| 2.42k| (((png_uint_32)(*(buf)) << 24) + \ | | | | | | 2824| 2.42k| ((png_uint_32)(*((buf) + 1)) << 16) + \ | | | | | | 2825| 2.42k| ((png_uint_32)(*((buf) + 2)) << 8) + \ | | | | | | 2826| 2.42k| ((png_uint_32)(*((buf) + 3)))) | | | | ------------------ | | ------------------ ------------------ 1410| 2.42k| png_bytep profile = png_read_buffer(png_ptr, 1411| 2.42k| profile_length); 1412| | 1413| 2.42k| if (profile != NULL) ------------------ | Branch (1413:29): [True: 2.42k, False: 0] ------------------ 1414| 2.42k| { 1415| 2.42k| memcpy(profile, profile_header, 1416| 2.42k| (sizeof profile_header)); 1417| | 1418| 2.42k| size = 12 * tag_count; 1419| | 1420| 2.42k| (void)png_inflate_read(png_ptr, local_buffer, 1421| 2.42k| (sizeof local_buffer), &length, 1422| 2.42k| profile + (sizeof profile_header), &size, 0); 1423| | 1424| | /* Still expect a buffer error because we expect 1425| | * there to be some tag data! 1426| | */ 1427| 2.42k| if (size == 0) ------------------ | Branch (1427:32): [True: 1.95k, False: 463] ------------------ 1428| 1.95k| { 1429| 1.95k| if (png_icc_check_tag_table(png_ptr, ------------------ | | 70| 1.95k|#define png_icc_check_tag_table OSS_FUZZ_png_icc_check_tag_table ------------------ | Branch (1429:35): [True: 1.64k, False: 312] ------------------ 1430| 1.95k| keyword, profile_length, profile) != 0) 1431| 1.64k| { 1432| | /* The profile has been validated for basic 1433| | * security issues, so read the whole thing in. 1434| | */ 1435| 1.64k| size = profile_length - (sizeof profile_header) 1436| 1.64k| - 12 * tag_count; 1437| | 1438| 1.64k| (void)png_inflate_read(png_ptr, local_buffer, 1439| 1.64k| (sizeof local_buffer), &length, 1440| 1.64k| profile + (sizeof profile_header) + 1441| 1.64k| 12 * tag_count, &size, 1/*finish*/); 1442| | 1443| 1.64k| if (length > 0 && !(png_ptr->flags & ------------------ | Branch (1443:38): [True: 957, False: 688] | Branch (1443:52): [True: 0, False: 957] ------------------ 1444| 957| PNG_FLAG_BENIGN_ERRORS_WARN)) ------------------ | | 715| 957|#define PNG_FLAG_BENIGN_ERRORS_WARN 0x100000U /* Added to libpng-1.4.0 */ ------------------ 1445| 0| errmsg = "extra compressed data"; 1446| | 1447| | /* But otherwise allow extra data: */ 1448| 1.64k| else if (size == 0) ------------------ | Branch (1448:43): [True: 11, False: 1.63k] ------------------ 1449| 11| { 1450| 11| if (length > 0) ------------------ | Branch (1450:41): [True: 8, False: 3] ------------------ 1451| 8| { 1452| | /* This can be handled completely, so 1453| | * keep going. 1454| | */ 1455| 8| png_chunk_warning(png_ptr, ------------------ | | 240| 8|#define png_chunk_warning OSS_FUZZ_png_chunk_warning ------------------ 1456| 8| "extra compressed data"); 1457| 8| } 1458| | 1459| 11| png_crc_finish(png_ptr, length); ------------------ | | 25| 11|#define png_crc_finish OSS_FUZZ_png_crc_finish ------------------ 1460| 11| finished = 1; 1461| | 1462| | /* Steal the profile for info_ptr. */ 1463| 11| if (info_ptr != NULL) ------------------ | Branch (1463:41): [True: 9, False: 2] ------------------ 1464| 9| { 1465| 9| png_free_data(png_ptr, info_ptr, ------------------ | | 254| 9|#define png_free_data OSS_FUZZ_png_free_data ------------------ 1466| 9| PNG_FREE_ICCP, 0); ------------------ | | 1839| 9|#define PNG_FREE_ICCP 0x0010U ------------------ 1467| | 1468| 9| info_ptr->iccp_name = png_voidcast(char*, ------------------ | | 535| 9|# define png_voidcast(type, value) (value) ------------------ 1469| 9| png_malloc_base(png_ptr, 1470| 9| keyword_length+1)); 1471| 9| if (info_ptr->iccp_name != NULL) ------------------ | Branch (1471:44): [True: 9, False: 0] ------------------ 1472| 9| { 1473| 9| memcpy(info_ptr->iccp_name, keyword, 1474| 9| keyword_length+1); 1475| 9| info_ptr->iccp_proflen = 1476| 9| profile_length; 1477| 9| info_ptr->iccp_profile = profile; 1478| 9| png_ptr->read_buffer = NULL; /*steal*/ 1479| 9| info_ptr->free_me |= PNG_FREE_ICCP; ------------------ | | 1839| 9|#define PNG_FREE_ICCP 0x0010U ------------------ 1480| 9| info_ptr->valid |= PNG_INFO_iCCP; ------------------ | | 742| 9|#define PNG_INFO_iCCP 0x1000U /* ESR, 1.0.6 */ ------------------ 1481| 9| } 1482| | 1483| 0| else 1484| 0| errmsg = "out of memory"; 1485| 9| } 1486| | 1487| | /* else the profile remains in the read 1488| | * buffer which gets reused for subsequent 1489| | * chunks. 1490| | */ 1491| | 1492| 11| if (errmsg == NULL) ------------------ | Branch (1492:41): [True: 9, False: 2] ------------------ 1493| 9| { 1494| 9| png_ptr->zowner = 0; 1495| 9| return handled_ok; 1496| 9| } 1497| 11| } 1498| 1.63k| if (errmsg == NULL) ------------------ | Branch (1498:38): [True: 1.59k, False: 40] ------------------ 1499| 1.59k| errmsg = png_ptr->zstream.msg; 1500| 1.63k| } 1501| | /* else png_icc_check_tag_table output an error */ 1502| 1.95k| } 1503| 463| else /* profile truncated */ 1504| 463| errmsg = png_ptr->zstream.msg; 1505| 2.42k| } 1506| | 1507| 0| else 1508| 0| errmsg = "out of memory"; 1509| 2.42k| } 1510| | 1511| | /* else png_icc_check_header output an error */ 1512| 6.29k| } 1513| | 1514| | /* else png_icc_check_length output an error */ 1515| 6.79k| } 1516| | 1517| 1.09k| else /* profile truncated */ 1518| 1.09k| errmsg = png_ptr->zstream.msg; 1519| | 1520| | /* Release the stream */ 1521| 7.88k| png_ptr->zowner = 0; 1522| 7.88k| } 1523| | 1524| 0| else /* png_inflate_claim failed */ 1525| 0| errmsg = png_ptr->zstream.msg; 1526| 7.89k| } 1527| | 1528| 301| else 1529| 301| errmsg = "bad compression method"; /* or missing */ 1530| 8.19k| } 1531| | 1532| 341| else 1533| 341| errmsg = "bad keyword"; 1534| 8.53k| } 1535| | 1536| | /* Failure: the reason is in 'errmsg' */ 1537| 8.52k| if (finished == 0) ------------------ | Branch (1537:8): [True: 8.39k, False: 132] ------------------ 1538| 8.39k| png_crc_finish(png_ptr, length); ------------------ | | 25| 8.39k|#define png_crc_finish OSS_FUZZ_png_crc_finish ------------------ 1539| | 1540| 8.52k| if (errmsg != NULL) /* else already output */ ------------------ | Branch (1540:8): [True: 3.48k, False: 5.04k] ------------------ 1541| 3.48k| png_chunk_benign_error(png_ptr, errmsg); ------------------ | | 238| 3.48k|#define png_chunk_benign_error OSS_FUZZ_png_chunk_benign_error ------------------ 1542| | 1543| 8.52k| return handled_error; 1544| 8.53k|} pngrutil.c:png_inflate_read: 839| 11.9k|{ 840| 11.9k| if (png_ptr->zowner == png_ptr->chunk_name) ------------------ | Branch (840:8): [True: 11.9k, False: 0] ------------------ 841| 11.9k| { 842| 11.9k| int ret; 843| | 844| | /* next_in and avail_in must have been initialized by the caller. */ 845| 11.9k| png_ptr->zstream.next_out = next_out; 846| 11.9k| png_ptr->zstream.avail_out = 0; /* set in the loop */ 847| | 848| 11.9k| do 849| 13.9k| { 850| 13.9k| if (png_ptr->zstream.avail_in == 0) ------------------ | Branch (850:14): [True: 2.01k, False: 11.9k] ------------------ 851| 2.01k| { 852| 2.01k| if (read_size > *chunk_bytes) ------------------ | Branch (852:17): [True: 1.75k, False: 252] ------------------ 853| 1.75k| read_size = (uInt)*chunk_bytes; 854| 2.01k| *chunk_bytes -= read_size; 855| | 856| 2.01k| if (read_size > 0) ------------------ | Branch (856:17): [True: 1.61k, False: 399] ------------------ 857| 1.61k| png_crc_read(png_ptr, read_buffer, read_size); ------------------ | | 24| 1.61k|#define png_crc_read OSS_FUZZ_png_crc_read ------------------ 858| | 859| 2.01k| png_ptr->zstream.next_in = read_buffer; 860| 2.01k| png_ptr->zstream.avail_in = read_size; 861| 2.01k| } 862| | 863| 13.9k| if (png_ptr->zstream.avail_out == 0) ------------------ | Branch (863:14): [True: 11.9k, False: 1.96k] ------------------ 864| 11.9k| { 865| 11.9k| uInt avail = ZLIB_IO_MAX; ------------------ | | 53| 11.9k|# define ZLIB_IO_MAX ((uInt)-1) ------------------ 866| 11.9k| if (avail > *out_size) ------------------ | Branch (866:17): [True: 11.9k, False: 0] ------------------ 867| 11.9k| avail = (uInt)*out_size; 868| 11.9k| *out_size -= avail; 869| | 870| 11.9k| png_ptr->zstream.avail_out = avail; 871| 11.9k| } 872| | 873| | /* Use Z_SYNC_FLUSH when there is no more chunk data to ensure that all 874| | * the available output is produced; this allows reading of truncated 875| | * streams. 876| | */ 877| 13.9k| ret = PNG_INFLATE(png_ptr, *chunk_bytes > 0 ? ------------------ | | 1729| 31.6k|# define PNG_INFLATE(pp, flush) png_zlib_inflate(pp, flush) | | ------------------ | | | | 42| 13.9k|#define png_zlib_inflate OSS_FUZZ_png_zlib_inflate | | ------------------ | | | Branch (1729:55): [True: 650, False: 1.25k] | | | Branch (1729:55): [True: 12.0k, False: 1.90k] | | ------------------ ------------------ 878| 13.9k| Z_NO_FLUSH : (finish ? Z_FINISH : Z_SYNC_FLUSH)); 879| 13.9k| } 880| 13.9k| while (ret == Z_OK && (*out_size > 0 || png_ptr->zstream.avail_out > 0)); ------------------ | Branch (880:14): [True: 9.60k, False: 4.31k] | Branch (880:30): [True: 0, False: 9.60k] | Branch (880:47): [True: 1.96k, False: 7.63k] ------------------ 881| | 882| 11.9k| *out_size += png_ptr->zstream.avail_out; 883| 11.9k| png_ptr->zstream.avail_out = 0; /* Should not be required, but is safe */ 884| | 885| | /* Ensure the error message pointer is always set: */ 886| 11.9k| png_zstream_error(png_ptr, ret); ------------------ | | 4| 11.9k|#define png_zstream_error OSS_FUZZ_png_zstream_error ------------------ 887| 11.9k| return ret; 888| 11.9k| } 889| | 890| 0| else 891| 0| { 892| 0| png_ptr->zstream.msg = PNGZ_MSG_CAST("zstream unclaimed"); ------------------ | | 40| 0|# define PNGZ_MSG_CAST(s) (s) ------------------ 893| | return Z_STREAM_ERROR; 894| 0| } 895| 11.9k|} pngrutil.c:png_handle_iTXt: 2564| 4.59k|{ 2565| 4.59k| png_const_charp errmsg = NULL; 2566| 4.59k| png_bytep buffer; 2567| 4.59k| png_uint_32 prefix_length; 2568| | 2569| 4.59k| png_debug(1, "in png_handle_iTXt"); ------------------ | | 145| 4.59k|# define png_debug(l, m) ((void)0) ------------------ 2570| | 2571| 4.59k|#ifdef PNG_USER_LIMITS_SUPPORTED 2572| 4.59k| if (png_ptr->user_chunk_cache_max != 0) ------------------ | Branch (2572:8): [True: 4.59k, False: 0] ------------------ 2573| 4.59k| { 2574| 4.59k| if (png_ptr->user_chunk_cache_max == 1) ------------------ | Branch (2574:11): [True: 206, False: 4.38k] ------------------ 2575| 206| { 2576| 206| png_crc_finish(png_ptr, length); ------------------ | | 25| 206|#define png_crc_finish OSS_FUZZ_png_crc_finish ------------------ 2577| 206| return handled_error; 2578| 206| } 2579| | 2580| 4.38k| if (--png_ptr->user_chunk_cache_max == 1) ------------------ | Branch (2580:11): [True: 12, False: 4.37k] ------------------ 2581| 12| { 2582| 12| png_crc_finish(png_ptr, length); ------------------ | | 25| 12|#define png_crc_finish OSS_FUZZ_png_crc_finish ------------------ 2583| 12| png_chunk_benign_error(png_ptr, "no space in chunk cache"); ------------------ | | 238| 12|#define png_chunk_benign_error OSS_FUZZ_png_chunk_benign_error ------------------ 2584| 12| return handled_error; 2585| 12| } 2586| 4.38k| } 2587| 4.37k|#endif 2588| | 2589| 4.37k| buffer = png_read_buffer(png_ptr, length+1); 2590| | 2591| 4.37k| if (buffer == NULL) ------------------ | Branch (2591:8): [True: 20, False: 4.35k] ------------------ 2592| 20| { 2593| 20| png_crc_finish(png_ptr, length); ------------------ | | 25| 20|#define png_crc_finish OSS_FUZZ_png_crc_finish ------------------ 2594| 20| png_chunk_benign_error(png_ptr, "out of memory"); ------------------ | | 238| 20|#define png_chunk_benign_error OSS_FUZZ_png_chunk_benign_error ------------------ 2595| 20| return handled_error; 2596| 20| } 2597| | 2598| 4.35k| png_crc_read(png_ptr, buffer, length); ------------------ | | 24| 4.35k|#define png_crc_read OSS_FUZZ_png_crc_read ------------------ 2599| | 2600| 4.35k| if (png_crc_finish(png_ptr, 0) != 0) ------------------ | | 25| 4.35k|#define png_crc_finish OSS_FUZZ_png_crc_finish ------------------ | Branch (2600:8): [True: 1.28k, False: 3.06k] ------------------ 2601| 1.28k| return handled_error; 2602| | 2603| | /* First the keyword. */ 2604| 3.06k| for (prefix_length=0; 2605| 19.0k| prefix_length < length && buffer[prefix_length] != 0; ------------------ | Branch (2605:7): [True: 18.7k, False: 343] | Branch (2605:33): [True: 16.0k, False: 2.72k] ------------------ 2606| 16.0k| ++prefix_length) 2607| 16.0k| /* Empty loop */ ; 2608| | 2609| | /* Perform a basic check on the keyword length here. */ 2610| 3.06k| if (prefix_length > 79 || prefix_length < 1) ------------------ | Branch (2610:8): [True: 95, False: 2.97k] | Branch (2610:30): [True: 211, False: 2.76k] ------------------ 2611| 212| errmsg = "bad keyword"; 2612| | 2613| | /* Expect keyword, compression flag, compression type, language, translated 2614| | * keyword (both may be empty but are 0 terminated) then the text, which may 2615| | * be empty. 2616| | */ 2617| 2.85k| else if (prefix_length + 5 > length) ------------------ | Branch (2617:13): [True: 254, False: 2.60k] ------------------ 2618| 254| errmsg = "truncated"; 2619| | 2620| 2.60k| else if (buffer[prefix_length+1] == 0 || ------------------ | Branch (2620:13): [True: 691, False: 1.90k] ------------------ 2621| 1.90k| (buffer[prefix_length+1] == 1 && ------------------ | Branch (2621:8): [True: 622, False: 1.28k] ------------------ 2622| 622| buffer[prefix_length+2] == PNG_COMPRESSION_TYPE_BASE)) ------------------ | | 676| 622|#define PNG_COMPRESSION_TYPE_BASE 0 /* Deflate method 8, 32K window */ ------------------ | Branch (2622:7): [True: 428, False: 194] ------------------ 2623| 1.02k| { 2624| 1.02k| int compressed = buffer[prefix_length+1] != 0; 2625| 1.02k| png_uint_32 language_offset, translated_keyword_offset; 2626| 1.02k| png_alloc_size_t uncompressed_length = 0; 2627| | 2628| | /* Now the language tag */ 2629| 1.02k| prefix_length += 3; 2630| 1.02k| language_offset = prefix_length; 2631| | 2632| 4.25k| for (; prefix_length < length && buffer[prefix_length] != 0; ------------------ | Branch (2632:14): [True: 4.05k, False: 201] | Branch (2632:40): [True: 3.23k, False: 824] ------------------ 2633| 3.23k| ++prefix_length) 2634| 3.23k| /* Empty loop */ ; 2635| | 2636| | /* WARNING: the length may be invalid here, this is checked below. */ 2637| 1.02k| translated_keyword_offset = ++prefix_length; 2638| | 2639| 20.5k| for (; prefix_length < length && buffer[prefix_length] != 0; ------------------ | Branch (2639:14): [True: 20.1k, False: 399] | Branch (2639:40): [True: 19.5k, False: 626] ------------------ 2640| 19.5k| ++prefix_length) 2641| 19.5k| /* Empty loop */ ; 2642| | 2643| | /* prefix_length should now be at the trailing '\0' of the translated 2644| | * keyword, but it may already be over the end. None of this arithmetic 2645| | * can overflow because chunks are at most 2^31 bytes long, but on 16-bit 2646| | * systems the available allocation may overflow. 2647| | */ 2648| 1.02k| ++prefix_length; 2649| | 2650| 1.02k| if (compressed == 0 && prefix_length <= length) ------------------ | Branch (2650:11): [True: 597, False: 428] | Branch (2650:30): [True: 392, False: 205] ------------------ 2651| 392| uncompressed_length = length - prefix_length; 2652| | 2653| 633| else if (compressed != 0 && prefix_length < length) ------------------ | Branch (2653:16): [True: 428, False: 205] | Branch (2653:35): [True: 234, False: 194] ------------------ 2654| 234| { 2655| 234| uncompressed_length = PNG_SIZE_MAX; ------------------ | | 649| 234|#define PNG_SIZE_MAX ((size_t)(-1)) ------------------ 2656| | 2657| | /* TODO: at present png_decompress_chunk imposes a single application 2658| | * level memory limit, this should be split to different values for 2659| | * iCCP and text chunks. 2660| | */ 2661| 234| if (png_decompress_chunk(png_ptr, length, prefix_length, ------------------ | Branch (2661:14): [True: 194, False: 40] ------------------ 2662| 234| &uncompressed_length, 1/*terminate*/) == Z_STREAM_END) 2663| 194| buffer = png_ptr->read_buffer; 2664| | 2665| 40| else 2666| 40| errmsg = png_ptr->zstream.msg; 2667| 234| } 2668| | 2669| 399| else 2670| 399| errmsg = "truncated"; 2671| | 2672| 1.02k| if (errmsg == NULL) ------------------ | Branch (2672:11): [True: 586, False: 439] ------------------ 2673| 586| { 2674| 586| png_text text; 2675| | 2676| 586| buffer[uncompressed_length+prefix_length] = 0; 2677| | 2678| 586| if (compressed == 0) ------------------ | Branch (2678:14): [True: 392, False: 194] ------------------ 2679| 392| text.compression = PNG_ITXT_COMPRESSION_NONE; ------------------ | | 588| 392|#define PNG_ITXT_COMPRESSION_NONE 1 ------------------ 2680| | 2681| 194| else 2682| 194| text.compression = PNG_ITXT_COMPRESSION_zTXt; ------------------ | | 589| 194|#define PNG_ITXT_COMPRESSION_zTXt 2 ------------------ 2683| | 2684| 586| text.key = (png_charp)buffer; 2685| 586| text.lang = (png_charp)buffer + language_offset; 2686| 586| text.lang_key = (png_charp)buffer + translated_keyword_offset; 2687| 586| text.text = (png_charp)buffer + prefix_length; 2688| 586| text.text_length = 0; 2689| 586| text.itxt_length = uncompressed_length; 2690| | 2691| 586| if (png_set_text_2(png_ptr, info_ptr, &text, 1) == 0) ------------------ | | 31| 586|#define png_set_text_2 OSS_FUZZ_png_set_text_2 ------------------ | Branch (2691:14): [True: 586, False: 0] ------------------ 2692| 586| return handled_ok; 2693| | 2694| 0| errmsg = "out of memory"; 2695| 0| } 2696| 1.02k| } 2697| | 2698| 1.57k| else 2699| 1.57k| errmsg = "bad compression info"; 2700| | 2701| 2.48k| if (errmsg != NULL) ------------------ | Branch (2701:8): [True: 2.38k, False: 94] ------------------ 2702| 2.38k| png_chunk_benign_error(png_ptr, errmsg); ------------------ | | 238| 2.38k|#define png_chunk_benign_error OSS_FUZZ_png_chunk_benign_error ------------------ 2703| 2.48k| return handled_error; 2704| 3.06k|} pngrutil.c:png_decompress_chunk: 685| 1.29k|{ 686| | /* TODO: implement different limits for different types of chunk. 687| | * 688| | * The caller supplies *newlength set to the maximum length of the 689| | * uncompressed data, but this routine allocates space for the prefix and 690| | * maybe a '\0' terminator too. We have to assume that 'prefix_size' is 691| | * limited only by the maximum chunk size. 692| | */ 693| 1.29k| png_alloc_size_t limit = png_chunk_max(png_ptr); ------------------ | | 1126| 1.29k|# define png_chunk_max(png_ptr) ((png_ptr)->user_chunk_malloc_max) ------------------ 694| | 695| 1.29k| if (limit >= prefix_size + (terminate != 0)) ------------------ | Branch (695:8): [True: 1.29k, False: 0] ------------------ 696| 1.29k| { 697| 1.29k| int ret; 698| | 699| 1.29k| limit -= prefix_size + (terminate != 0); 700| | 701| 1.29k| if (limit < *newlength) ------------------ | Branch (701:11): [True: 1.29k, False: 0] ------------------ 702| 1.29k| *newlength = limit; 703| | 704| | /* Now try to claim the stream. */ 705| 1.29k| ret = png_inflate_claim(png_ptr, png_ptr->chunk_name); 706| | 707| 1.29k| if (ret == Z_OK) ------------------ | Branch (707:11): [True: 1.29k, False: 0] ------------------ 708| 1.29k| { 709| 1.29k| png_uint_32 lzsize = chunklength - prefix_size; 710| | 711| 1.29k| ret = png_inflate(png_ptr, png_ptr->chunk_name, 1/*finish*/, 712| 1.29k| /* input: */ png_ptr->read_buffer + prefix_size, &lzsize, 713| 1.29k| /* output: */ NULL, newlength); 714| | 715| 1.29k| if (ret == Z_STREAM_END) ------------------ | Branch (715:14): [True: 398, False: 898] ------------------ 716| 398| { 717| | /* Use 'inflateReset' here, not 'inflateReset2' because this 718| | * preserves the previously decided window size (otherwise it would 719| | * be necessary to store the previous window size.) In practice 720| | * this doesn't matter anyway, because png_inflate will call inflate 721| | * with Z_FINISH in almost all cases, so the window will not be 722| | * maintained. 723| | */ 724| 398| if (inflateReset(&png_ptr->zstream) == Z_OK) ------------------ | Branch (724:17): [True: 398, False: 0] ------------------ 725| 398| { 726| | /* Because of the limit checks above we know that the new, 727| | * expanded, size will fit in a size_t (let alone an 728| | * png_alloc_size_t). Use png_malloc_base here to avoid an 729| | * extra OOM message. 730| | */ 731| 398| png_alloc_size_t new_size = *newlength; 732| 398| png_alloc_size_t buffer_size = prefix_size + new_size + 733| 398| (terminate != 0); 734| 398| png_bytep text = png_voidcast(png_bytep, png_malloc_base(png_ptr, ------------------ | | 535| 398|# define png_voidcast(type, value) (value) ------------------ 735| 398| buffer_size)); 736| | 737| 398| if (text != NULL) ------------------ | Branch (737:20): [True: 398, False: 0] ------------------ 738| 398| { 739| 398| memset(text, 0, buffer_size); 740| | 741| 398| ret = png_inflate(png_ptr, png_ptr->chunk_name, 1/*finish*/, 742| 398| png_ptr->read_buffer + prefix_size, &lzsize, 743| 398| text + prefix_size, newlength); 744| | 745| 398| if (ret == Z_STREAM_END) ------------------ | Branch (745:23): [True: 398, False: 0] ------------------ 746| 398| { 747| 398| if (new_size == *newlength) ------------------ | Branch (747:26): [True: 398, False: 0] ------------------ 748| 398| { 749| 398| if (terminate != 0) ------------------ | Branch (749:29): [True: 398, False: 0] ------------------ 750| 398| text[prefix_size + *newlength] = 0; 751| | 752| 398| if (prefix_size > 0) ------------------ | Branch (752:29): [True: 398, False: 0] ------------------ 753| 398| memcpy(text, png_ptr->read_buffer, prefix_size); 754| | 755| 398| { 756| 398| png_bytep old_ptr = png_ptr->read_buffer; 757| | 758| 398| png_ptr->read_buffer = text; 759| 398| png_ptr->read_buffer_size = buffer_size; 760| 398| text = old_ptr; /* freed below */ 761| 398| } 762| 398| } 763| | 764| 0| else 765| 0| { 766| | /* The size changed on the second read, there can be no 767| | * guarantee that anything is correct at this point. 768| | * The 'msg' pointer has been set to "unexpected end of 769| | * LZ stream", which is fine, but return an error code 770| | * that the caller won't accept. 771| | */ 772| 0| ret = PNG_UNEXPECTED_ZLIB_RETURN; ------------------ | | 1077| 0|#define PNG_UNEXPECTED_ZLIB_RETURN (-7) ------------------ 773| 0| } 774| 398| } 775| | 776| 0| else if (ret == Z_OK) ------------------ | Branch (776:28): [True: 0, False: 0] ------------------ 777| 0| ret = PNG_UNEXPECTED_ZLIB_RETURN; /* for safety */ ------------------ | | 1077| 0|#define PNG_UNEXPECTED_ZLIB_RETURN (-7) ------------------ 778| | 779| | /* Free the text pointer (this is the old read_buffer on 780| | * success) 781| | */ 782| 398| png_free(png_ptr, text); ------------------ | | 253| 398|#define png_free OSS_FUZZ_png_free ------------------ 783| | 784| | /* This really is very benign, but it's still an error because 785| | * the extra space may otherwise be used as a Trojan Horse. 786| | */ 787| 398| if (ret == Z_STREAM_END && ------------------ | Branch (787:23): [True: 398, False: 0] ------------------ 788| 398| chunklength - prefix_size != lzsize) ------------------ | Branch (788:23): [True: 10, False: 388] ------------------ 789| 10| png_chunk_benign_error(png_ptr, "extra compressed data"); ------------------ | | 238| 10|#define png_chunk_benign_error OSS_FUZZ_png_chunk_benign_error ------------------ 790| 398| } 791| | 792| 0| else 793| 0| { 794| | /* Out of memory allocating the buffer */ 795| 0| ret = Z_MEM_ERROR; 796| 0| png_zstream_error(png_ptr, Z_MEM_ERROR); ------------------ | | 4| 0|#define png_zstream_error OSS_FUZZ_png_zstream_error ------------------ 797| 0| } 798| 398| } 799| | 800| 0| else 801| 0| { 802| | /* inflateReset failed, store the error message */ 803| 0| png_zstream_error(png_ptr, ret); ------------------ | | 4| 0|#define png_zstream_error OSS_FUZZ_png_zstream_error ------------------ 804| 0| ret = PNG_UNEXPECTED_ZLIB_RETURN; ------------------ | | 1077| 0|#define PNG_UNEXPECTED_ZLIB_RETURN (-7) ------------------ 805| 0| } 806| 398| } 807| | 808| 898| else if (ret == Z_OK) ------------------ | Branch (808:19): [True: 0, False: 898] ------------------ 809| 0| ret = PNG_UNEXPECTED_ZLIB_RETURN; ------------------ | | 1077| 0|#define PNG_UNEXPECTED_ZLIB_RETURN (-7) ------------------ 810| | 811| | /* Release the claimed stream */ 812| 1.29k| png_ptr->zowner = 0; 813| 1.29k| } 814| | 815| 0| else /* the claim failed */ if (ret == Z_STREAM_END) /* impossible! */ ------------------ | Branch (815:39): [True: 0, False: 0] ------------------ 816| 0| ret = PNG_UNEXPECTED_ZLIB_RETURN; ------------------ | | 1077| 0|#define PNG_UNEXPECTED_ZLIB_RETURN (-7) ------------------ 817| | 818| 1.29k| return ret; 819| 1.29k| } 820| | 821| 0| else 822| 0| { 823| | /* Application/configuration limits exceeded */ 824| 0| png_zstream_error(png_ptr, Z_MEM_ERROR); ------------------ | | 4| 0|#define png_zstream_error OSS_FUZZ_png_zstream_error ------------------ 825| | return Z_MEM_ERROR; 826| 0| } 827| 1.29k|} pngrutil.c:png_inflate: 559| 1.69k|{ 560| 1.69k| if (png_ptr->zowner == owner) /* Else not claimed */ ------------------ | Branch (560:8): [True: 1.69k, False: 0] ------------------ 561| 1.69k| { 562| 1.69k| int ret; 563| 1.69k| png_alloc_size_t avail_out = *output_size_ptr; 564| 1.69k| png_uint_32 avail_in = *input_size_ptr; 565| | 566| | /* zlib can't necessarily handle more than 65535 bytes at once (i.e. it 567| | * can't even necessarily handle 65536 bytes) because the type uInt is 568| | * "16 bits or more". Consequently it is necessary to chunk the input to 569| | * zlib. This code uses ZLIB_IO_MAX, from pngpriv.h, as the maximum (the 570| | * maximum value that can be stored in a uInt.) It is possible to set 571| | * ZLIB_IO_MAX to a lower value in pngpriv.h and this may sometimes have 572| | * a performance advantage, because it reduces the amount of data accessed 573| | * at each step and that may give the OS more time to page it in. 574| | */ 575| 1.69k| png_ptr->zstream.next_in = PNGZ_INPUT_CAST(input); ------------------ | | 41| 1.69k|# define PNGZ_INPUT_CAST(b) (b) ------------------ 576| | /* avail_in and avail_out are set below from 'size' */ 577| 1.69k| png_ptr->zstream.avail_in = 0; 578| 1.69k| png_ptr->zstream.avail_out = 0; 579| | 580| | /* Read directly into the output if it is available (this is set to 581| | * a local buffer below if output is NULL). 582| | */ 583| 1.69k| if (output != NULL) ------------------ | Branch (583:11): [True: 398, False: 1.29k] ------------------ 584| 398| png_ptr->zstream.next_out = output; 585| | 586| 1.69k| do 587| 2.26k| { 588| 2.26k| uInt avail; 589| 2.26k| Byte local_buffer[PNG_INFLATE_BUF_SIZE]; 590| | 591| | /* zlib INPUT BUFFER */ 592| | /* The setting of 'avail_in' used to be outside the loop; by setting it 593| | * inside it is possible to chunk the input to zlib and simply rely on 594| | * zlib to advance the 'next_in' pointer. This allows arbitrary 595| | * amounts of data to be passed through zlib at the unavoidable cost of 596| | * requiring a window save (memcpy of up to 32768 output bytes) 597| | * every ZLIB_IO_MAX input bytes. 598| | */ 599| 2.26k| avail_in += png_ptr->zstream.avail_in; /* not consumed last time */ 600| | 601| 2.26k| avail = ZLIB_IO_MAX; ------------------ | | 53| 2.26k|# define ZLIB_IO_MAX ((uInt)-1) ------------------ 602| | 603| 2.26k| if (avail_in < avail) ------------------ | Branch (603:14): [True: 2.26k, False: 0] ------------------ 604| 2.26k| avail = (uInt)avail_in; /* safe: < than ZLIB_IO_MAX */ 605| | 606| 2.26k| avail_in -= avail; 607| 2.26k| png_ptr->zstream.avail_in = avail; 608| | 609| | /* zlib OUTPUT BUFFER */ 610| 2.26k| avail_out += png_ptr->zstream.avail_out; /* not written last time */ 611| | 612| 2.26k| avail = ZLIB_IO_MAX; /* maximum zlib can process */ ------------------ | | 53| 2.26k|# define ZLIB_IO_MAX ((uInt)-1) ------------------ 613| | 614| 2.26k| if (output == NULL) ------------------ | Branch (614:14): [True: 1.86k, False: 398] ------------------ 615| 1.86k| { 616| | /* Reset the output buffer each time round if output is NULL and 617| | * make available the full buffer, up to 'remaining_space' 618| | */ 619| 1.86k| png_ptr->zstream.next_out = local_buffer; 620| 1.86k| if ((sizeof local_buffer) < avail) ------------------ | Branch (620:17): [True: 1.86k, False: 0] ------------------ 621| 1.86k| avail = (sizeof local_buffer); 622| 1.86k| } 623| | 624| 2.26k| if (avail_out < avail) ------------------ | Branch (624:14): [True: 398, False: 1.86k] ------------------ 625| 398| avail = (uInt)avail_out; /* safe: < ZLIB_IO_MAX */ 626| | 627| 2.26k| png_ptr->zstream.avail_out = avail; 628| 2.26k| avail_out -= avail; 629| | 630| | /* zlib inflate call */ 631| | /* In fact 'avail_out' may be 0 at this point, that happens at the end 632| | * of the read when the final LZ end code was not passed at the end of 633| | * the previous chunk of input data. Tell zlib if we have reached the 634| | * end of the output buffer. 635| | */ 636| 2.26k| ret = PNG_INFLATE(png_ptr, avail_out > 0 ? Z_NO_FLUSH : ------------------ | | 1729| 5.32k|# define PNG_INFLATE(pp, flush) png_zlib_inflate(pp, flush) | | ------------------ | | | | 42| 2.26k|#define png_zlib_inflate OSS_FUZZ_png_zlib_inflate | | ------------------ | | | Branch (1729:55): [True: 398, False: 0] | | | Branch (1729:55): [True: 1.86k, False: 398] | | ------------------ ------------------ 637| 2.26k| (finish ? Z_FINISH : Z_SYNC_FLUSH)); 638| 2.26k| } while (ret == Z_OK); ------------------ | Branch (638:16): [True: 572, False: 1.69k] ------------------ 639| | 640| | /* For safety kill the local buffer pointer now */ 641| 1.69k| if (output == NULL) ------------------ | Branch (641:11): [True: 1.29k, False: 398] ------------------ 642| 1.29k| png_ptr->zstream.next_out = NULL; 643| | 644| | /* Claw back the 'size' and 'remaining_space' byte counts. */ 645| 1.69k| avail_in += png_ptr->zstream.avail_in; 646| 1.69k| avail_out += png_ptr->zstream.avail_out; 647| | 648| | /* Update the input and output sizes; the updated values are the amount 649| | * consumed or written, effectively the inverse of what zlib uses. 650| | */ 651| 1.69k| if (avail_out > 0) ------------------ | Branch (651:11): [True: 1.29k, False: 398] ------------------ 652| 1.29k| *output_size_ptr -= avail_out; 653| | 654| 1.69k| if (avail_in > 0) ------------------ | Branch (654:11): [True: 336, False: 1.35k] ------------------ 655| 336| *input_size_ptr -= avail_in; 656| | 657| | /* Ensure png_ptr->zstream.msg is set (even in the success case!) */ 658| 1.69k| png_zstream_error(png_ptr, ret); ------------------ | | 4| 1.69k|#define png_zstream_error OSS_FUZZ_png_zstream_error ------------------ 659| 1.69k| return ret; 660| 1.69k| } 661| | 662| 0| else 663| 0| { 664| | /* This is a bad internal error. The recovery assigns to the zstream msg 665| | * pointer, which is not owned by the caller, but this is safe; it's only 666| | * used on errors! 667| | */ 668| 0| png_ptr->zstream.msg = PNGZ_MSG_CAST("zstream unclaimed"); ------------------ | | 40| 0|# define PNGZ_MSG_CAST(s) (s) ------------------ 669| | return Z_STREAM_ERROR; 670| 0| } 671| 1.69k|} pngrutil.c:png_handle_mDCV: 1946| 803|{ 1947| 803| png_xy chromaticities; 1948| 803| png_byte buf[24]; 1949| | 1950| 803| png_debug(1, "in png_handle_mDCV"); ------------------ | | 145| 803|# define png_debug(l, m) ((void)0) ------------------ 1951| | 1952| 803| png_crc_read(png_ptr, buf, 24); ------------------ | | 24| 803|#define png_crc_read OSS_FUZZ_png_crc_read ------------------ 1953| | 1954| 803| if (png_crc_finish(png_ptr, 0) != 0) ------------------ | | 25| 803|#define png_crc_finish OSS_FUZZ_png_crc_finish ------------------ | Branch (1954:8): [True: 735, False: 68] ------------------ 1955| 735| return handled_error; 1956| | 1957| | /* The error checking happens here, this puts it in just one place. The 1958| | * odd /50000 scaling factor makes it more difficult but the (x.y) values are 1959| | * only two bytes so a <<1 is safe. 1960| | * 1961| | * WARNING: the PNG specification defines the cHRM chunk to **start** with 1962| | * the white point (x,y). The W3C PNG v3 specification puts the white point 1963| | * **after* R,G,B. The x,y values in mDCV are also scaled by 50,000 and 1964| | * stored in just two bytes, whereas those in cHRM are scaled by 100,000 and 1965| | * stored in four bytes. This is very, very confusing. These APIs remove 1966| | * the confusion by copying the existing, well established, API. 1967| | */ 1968| 68| chromaticities.redx = png_get_uint_16(buf+ 0U) << 1; /* red x */ ------------------ | | 320| 68|#define png_get_uint_16 OSS_FUZZ_png_get_uint_16 | | ------------------ | | | | 463| 68|#define OSS_FUZZ_png_get_uint_16(buf) PNG_get_uint_16(buf) | | | | ------------------ | | | | | | 2832| 68| ((png_uint_16) \ | | | | | | 2833| 68| (((unsigned int)(*(buf)) << 8) + \ | | | | | | 2834| 68| ((unsigned int)(*((buf) + 1))))) | | | | ------------------ | | ------------------ ------------------ 1969| 68| chromaticities.redy = png_get_uint_16(buf+ 2U) << 1; /* red y */ ------------------ | | 320| 68|#define png_get_uint_16 OSS_FUZZ_png_get_uint_16 | | ------------------ | | | | 463| 68|#define OSS_FUZZ_png_get_uint_16(buf) PNG_get_uint_16(buf) | | | | ------------------ | | | | | | 2832| 68| ((png_uint_16) \ | | | | | | 2833| 68| (((unsigned int)(*(buf)) << 8) + \ | | | | | | 2834| 68| ((unsigned int)(*((buf) + 1))))) | | | | ------------------ | | ------------------ ------------------ 1970| 68| chromaticities.greenx = png_get_uint_16(buf+ 4U) << 1; /* green x */ ------------------ | | 320| 68|#define png_get_uint_16 OSS_FUZZ_png_get_uint_16 | | ------------------ | | | | 463| 68|#define OSS_FUZZ_png_get_uint_16(buf) PNG_get_uint_16(buf) | | | | ------------------ | | | | | | 2832| 68| ((png_uint_16) \ | | | | | | 2833| 68| (((unsigned int)(*(buf)) << 8) + \ | | | | | | 2834| 68| ((unsigned int)(*((buf) + 1))))) | | | | ------------------ | | ------------------ ------------------ 1971| 68| chromaticities.greeny = png_get_uint_16(buf+ 6U) << 1; /* green y */ ------------------ | | 320| 68|#define png_get_uint_16 OSS_FUZZ_png_get_uint_16 | | ------------------ | | | | 463| 68|#define OSS_FUZZ_png_get_uint_16(buf) PNG_get_uint_16(buf) | | | | ------------------ | | | | | | 2832| 68| ((png_uint_16) \ | | | | | | 2833| 68| (((unsigned int)(*(buf)) << 8) + \ | | | | | | 2834| 68| ((unsigned int)(*((buf) + 1))))) | | | | ------------------ | | ------------------ ------------------ 1972| 68| chromaticities.bluex = png_get_uint_16(buf+ 8U) << 1; /* blue x */ ------------------ | | 320| 68|#define png_get_uint_16 OSS_FUZZ_png_get_uint_16 | | ------------------ | | | | 463| 68|#define OSS_FUZZ_png_get_uint_16(buf) PNG_get_uint_16(buf) | | | | ------------------ | | | | | | 2832| 68| ((png_uint_16) \ | | | | | | 2833| 68| (((unsigned int)(*(buf)) << 8) + \ | | | | | | 2834| 68| ((unsigned int)(*((buf) + 1))))) | | | | ------------------ | | ------------------ ------------------ 1973| 68| chromaticities.bluey = png_get_uint_16(buf+10U) << 1; /* blue y */ ------------------ | | 320| 68|#define png_get_uint_16 OSS_FUZZ_png_get_uint_16 | | ------------------ | | | | 463| 68|#define OSS_FUZZ_png_get_uint_16(buf) PNG_get_uint_16(buf) | | | | ------------------ | | | | | | 2832| 68| ((png_uint_16) \ | | | | | | 2833| 68| (((unsigned int)(*(buf)) << 8) + \ | | | | | | 2834| 68| ((unsigned int)(*((buf) + 1))))) | | | | ------------------ | | ------------------ ------------------ 1974| 68| chromaticities.whitex = png_get_uint_16(buf+12U) << 1; /* white x */ ------------------ | | 320| 68|#define png_get_uint_16 OSS_FUZZ_png_get_uint_16 | | ------------------ | | | | 463| 68|#define OSS_FUZZ_png_get_uint_16(buf) PNG_get_uint_16(buf) | | | | ------------------ | | | | | | 2832| 68| ((png_uint_16) \ | | | | | | 2833| 68| (((unsigned int)(*(buf)) << 8) + \ | | | | | | 2834| 68| ((unsigned int)(*((buf) + 1))))) | | | | ------------------ | | ------------------ ------------------ 1975| 68| chromaticities.whitey = png_get_uint_16(buf+14U) << 1; /* white y */ ------------------ | | 320| 68|#define png_get_uint_16 OSS_FUZZ_png_get_uint_16 | | ------------------ | | | | 463| 68|#define OSS_FUZZ_png_get_uint_16(buf) PNG_get_uint_16(buf) | | | | ------------------ | | | | | | 2832| 68| ((png_uint_16) \ | | | | | | 2833| 68| (((unsigned int)(*(buf)) << 8) + \ | | | | | | 2834| 68| ((unsigned int)(*((buf) + 1))))) | | | | ------------------ | | ------------------ ------------------ 1976| | 1977| 68| png_set_mDCV_fixed(png_ptr, info_ptr, ------------------ | | 406| 68|#define png_set_mDCV_fixed OSS_FUZZ_png_set_mDCV_fixed ------------------ 1978| 68| chromaticities.whitex, chromaticities.whitey, 1979| 68| chromaticities.redx, chromaticities.redy, 1980| 68| chromaticities.greenx, chromaticities.greeny, 1981| 68| chromaticities.bluex, chromaticities.bluey, 1982| 68| png_get_uint_32(buf+16U), /* peak luminance */ ------------------ | | 322| 68|#define png_get_uint_32 OSS_FUZZ_png_get_uint_32 | | ------------------ | | | | 462| 68|#define OSS_FUZZ_png_get_uint_32(buf) PNG_get_uint_32(buf) | | | | ------------------ | | | | | | 2823| 68| (((png_uint_32)(*(buf)) << 24) + \ | | | | | | 2824| 68| ((png_uint_32)(*((buf) + 1)) << 16) + \ | | | | | | 2825| 68| ((png_uint_32)(*((buf) + 2)) << 8) + \ | | | | | | 2826| 68| ((png_uint_32)(*((buf) + 3)))) | | | | ------------------ | | ------------------ ------------------ 1983| 68| png_get_uint_32(buf+20U));/* minimum perceivable luminance */ ------------------ | | 322| 68|#define png_get_uint_32 OSS_FUZZ_png_get_uint_32 | | ------------------ | | | | 462| 68|#define OSS_FUZZ_png_get_uint_32(buf) PNG_get_uint_32(buf) | | | | ------------------ | | | | | | 2823| 68| (((png_uint_32)(*(buf)) << 24) + \ | | | | | | 2824| 68| ((png_uint_32)(*((buf) + 1)) << 16) + \ | | | | | | 2825| 68| ((png_uint_32)(*((buf) + 2)) << 8) + \ | | | | | | 2826| 68| ((png_uint_32)(*((buf) + 3)))) | | | | ------------------ | | ------------------ ------------------ 1984| | 1985| | /* We only use 'chromaticities' for RGB to gray */ 1986| 68|# ifdef PNG_READ_RGB_TO_GRAY_SUPPORTED 1987| 68| png_ptr->chromaticities = chromaticities; 1988| 68|# endif /* READ_RGB_TO_GRAY */ 1989| | 1990| 68| return handled_ok; 1991| 0| PNG_UNUSED(length) ------------------ | | 479| 0|# define PNG_UNUSED(param) (void)param; ------------------ 1992| 0|} pngrutil.c:png_handle_oFFs: 2114| 271|{ 2115| 271| png_byte buf[9]; 2116| 271| png_int_32 offset_x, offset_y; 2117| 271| int unit_type; 2118| | 2119| 271| png_debug(1, "in png_handle_oFFs"); ------------------ | | 145| 271|# define png_debug(l, m) ((void)0) ------------------ 2120| | 2121| 271| png_crc_read(png_ptr, buf, 9); ------------------ | | 24| 271|#define png_crc_read OSS_FUZZ_png_crc_read ------------------ 2122| | 2123| 271| if (png_crc_finish(png_ptr, 0) != 0) ------------------ | | 25| 271|#define png_crc_finish OSS_FUZZ_png_crc_finish ------------------ | Branch (2123:8): [True: 252, False: 19] ------------------ 2124| 252| return handled_error; 2125| | 2126| 19| offset_x = png_get_int_32(buf); ------------------ | | 288| 19|#define png_get_int_32 OSS_FUZZ_png_get_int_32 | | ------------------ | | | | 464| 19|#define OSS_FUZZ_png_get_int_32(buf) PNG_get_int_32(buf) | | | | ------------------ | | | | | | 2837| 19| ((png_int_32)((*(buf) & 0x80) \ | | | | | | ------------------ | | | | | | | Branch (2837:18): [True: 4, False: 15] | | | | | | ------------------ | | | | | | 2838| 19| ? -((png_int_32)(((png_get_uint_32(buf)^0xffffffffU)+1U)&0x7fffffffU)) \ | | | | | | ------------------ | | | | | | | | 322| 4|#define png_get_uint_32 OSS_FUZZ_png_get_uint_32 | | | | | | | | ------------------ | | | | | | | | | | 462| 4|#define OSS_FUZZ_png_get_uint_32(buf) PNG_get_uint_32(buf) | | | | | | | | | | ------------------ | | | | | | | | | | | | 2823| 4| (((png_uint_32)(*(buf)) << 24) + \ | | | | | | | | | | | | 2824| 4| ((png_uint_32)(*((buf) + 1)) << 16) + \ | | | | | | | | | | | | 2825| 4| ((png_uint_32)(*((buf) + 2)) << 8) + \ | | | | | | | | | | | | 2826| 4| ((png_uint_32)(*((buf) + 3)))) | | | | | | | | | | ------------------ | | | | | | | | ------------------ | | | | | | ------------------ | | | | | | 2839| 19| : (png_int_32)png_get_uint_32(buf))) | | | | | | ------------------ | | | | | | | | 322| 15|#define png_get_uint_32 OSS_FUZZ_png_get_uint_32 | | | | | | | | ------------------ | | | | | | | | | | 462| 15|#define OSS_FUZZ_png_get_uint_32(buf) PNG_get_uint_32(buf) | | | | | | | | | | ------------------ | | | | | | | | | | | | 2823| 15| (((png_uint_32)(*(buf)) << 24) + \ | | | | | | | | | | | | 2824| 15| ((png_uint_32)(*((buf) + 1)) << 16) + \ | | | | | | | | | | | | 2825| 15| ((png_uint_32)(*((buf) + 2)) << 8) + \ | | | | | | | | | | | | 2826| 15| ((png_uint_32)(*((buf) + 3)))) | | | | | | | | | | ------------------ | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 2127| 19| offset_y = png_get_int_32(buf + 4); ------------------ | | 288| 19|#define png_get_int_32 OSS_FUZZ_png_get_int_32 | | ------------------ | | | | 464| 19|#define OSS_FUZZ_png_get_int_32(buf) PNG_get_int_32(buf) | | | | ------------------ | | | | | | 2837| 19| ((png_int_32)((*(buf) & 0x80) \ | | | | | | ------------------ | | | | | | | Branch (2837:18): [True: 8, False: 11] | | | | | | ------------------ | | | | | | 2838| 19| ? -((png_int_32)(((png_get_uint_32(buf)^0xffffffffU)+1U)&0x7fffffffU)) \ | | | | | | ------------------ | | | | | | | | 322| 8|#define png_get_uint_32 OSS_FUZZ_png_get_uint_32 | | | | | | | | ------------------ | | | | | | | | | | 462| 8|#define OSS_FUZZ_png_get_uint_32(buf) PNG_get_uint_32(buf) | | | | | | | | | | ------------------ | | | | | | | | | | | | 2823| 8| (((png_uint_32)(*(buf)) << 24) + \ | | | | | | | | | | | | 2824| 8| ((png_uint_32)(*((buf) + 1)) << 16) + \ | | | | | | | | | | | | 2825| 8| ((png_uint_32)(*((buf) + 2)) << 8) + \ | | | | | | | | | | | | 2826| 8| ((png_uint_32)(*((buf) + 3)))) | | | | | | | | | | ------------------ | | | | | | | | ------------------ | | | | | | ------------------ | | | | | | 2839| 19| : (png_int_32)png_get_uint_32(buf))) | | | | | | ------------------ | | | | | | | | 322| 11|#define png_get_uint_32 OSS_FUZZ_png_get_uint_32 | | | | | | | | ------------------ | | | | | | | | | | 462| 11|#define OSS_FUZZ_png_get_uint_32(buf) PNG_get_uint_32(buf) | | | | | | | | | | ------------------ | | | | | | | | | | | | 2823| 11| (((png_uint_32)(*(buf)) << 24) + \ | | | | | | | | | | | | 2824| 11| ((png_uint_32)(*((buf) + 1)) << 16) + \ | | | | | | | | | | | | 2825| 11| ((png_uint_32)(*((buf) + 2)) << 8) + \ | | | | | | | | | | | | 2826| 11| ((png_uint_32)(*((buf) + 3)))) | | | | | | | | | | ------------------ | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 2128| 19| unit_type = buf[8]; 2129| 19| png_set_oFFs(png_ptr, info_ptr, offset_x, offset_y, unit_type); ------------------ | | 408| 19|#define png_set_oFFs OSS_FUZZ_png_set_oFFs ------------------ 2130| 19| return handled_ok; 2131| 0| PNG_UNUSED(length) ------------------ | | 479| 0|# define PNG_UNUSED(param) (void)param; ------------------ 2132| 0|} pngrutil.c:png_handle_pCAL: 2141| 2.50k|{ 2142| 2.50k| png_bytep buffer; 2143| 2.50k| png_bytep buf; 2144| 2.50k| png_bytep endptr; 2145| 2.50k| png_int_32 X0, X1; 2146| 2.50k| png_byte type; 2147| 2.50k| png_byte nparams; 2148| 2.50k| png_byte *units; 2149| 2.50k| png_charpp params; 2150| 2.50k| int i; 2151| | 2152| 2.50k| png_debug(1, "in png_handle_pCAL"); ------------------ | | 145| 2.50k|# define png_debug(l, m) ((void)0) ------------------ 2153| 2.50k| png_debug1(2, "Allocating and reading pCAL chunk data (%u bytes)", ------------------ | | 148| 2.50k|# define png_debug1(l, m, p1) ((void)0) ------------------ 2154| 2.50k| length + 1); 2155| | 2156| 2.50k| buffer = png_read_buffer(png_ptr, length+1); 2157| | 2158| 2.50k| if (buffer == NULL) ------------------ | Branch (2158:8): [True: 19, False: 2.48k] ------------------ 2159| 19| { 2160| 19| png_crc_finish(png_ptr, length); ------------------ | | 25| 19|#define png_crc_finish OSS_FUZZ_png_crc_finish ------------------ 2161| 19| png_chunk_benign_error(png_ptr, "out of memory"); ------------------ | | 238| 19|#define png_chunk_benign_error OSS_FUZZ_png_chunk_benign_error ------------------ 2162| 19| return handled_error; 2163| 19| } 2164| | 2165| 2.48k| png_crc_read(png_ptr, buffer, length); ------------------ | | 24| 2.48k|#define png_crc_read OSS_FUZZ_png_crc_read ------------------ 2166| | 2167| 2.48k| if (png_crc_finish(png_ptr, 0) != 0) ------------------ | | 25| 2.48k|#define png_crc_finish OSS_FUZZ_png_crc_finish ------------------ | Branch (2167:8): [True: 1.22k, False: 1.26k] ------------------ 2168| 1.22k| return handled_error; 2169| | 2170| 1.26k| buffer[length] = 0; /* Null terminate the last string */ 2171| | 2172| 1.26k| png_debug(3, "Finding end of pCAL purpose string"); ------------------ | | 145| 1.26k|# define png_debug(l, m) ((void)0) ------------------ 2173| 20.4k| for (buf = buffer; *buf; buf++) ------------------ | Branch (2173:23): [True: 19.1k, False: 1.26k] ------------------ 2174| 19.1k| /* Empty loop */ ; 2175| | 2176| 1.26k| endptr = buffer + length; 2177| | 2178| | /* We need to have at least 12 bytes after the purpose string 2179| | * in order to get the parameter information. 2180| | */ 2181| 1.26k| if (endptr - buf <= 12) ------------------ | Branch (2181:8): [True: 196, False: 1.06k] ------------------ 2182| 196| { 2183| 196| png_chunk_benign_error(png_ptr, "invalid"); ------------------ | | 238| 196|#define png_chunk_benign_error OSS_FUZZ_png_chunk_benign_error ------------------ 2184| 196| return handled_error; 2185| 196| } 2186| | 2187| 1.06k| png_debug(3, "Reading pCAL X0, X1, type, nparams, and units"); ------------------ | | 145| 1.06k|# define png_debug(l, m) ((void)0) ------------------ 2188| 1.06k| X0 = png_get_int_32((png_bytep)buf+1); ------------------ | | 288| 1.06k|#define png_get_int_32 OSS_FUZZ_png_get_int_32 | | ------------------ | | | | 464| 1.06k|#define OSS_FUZZ_png_get_int_32(buf) PNG_get_int_32(buf) | | | | ------------------ | | | | | | 2837| 1.06k| ((png_int_32)((*(buf) & 0x80) \ | | | | | | ------------------ | | | | | | | Branch (2837:18): [True: 201, False: 864] | | | | | | ------------------ | | | | | | 2838| 1.06k| ? -((png_int_32)(((png_get_uint_32(buf)^0xffffffffU)+1U)&0x7fffffffU)) \ | | | | | | ------------------ | | | | | | | | 322| 201|#define png_get_uint_32 OSS_FUZZ_png_get_uint_32 | | | | | | | | ------------------ | | | | | | | | | | 462| 201|#define OSS_FUZZ_png_get_uint_32(buf) PNG_get_uint_32(buf) | | | | | | | | | | ------------------ | | | | | | | | | | | | 2823| 201| (((png_uint_32)(*(buf)) << 24) + \ | | | | | | | | | | | | 2824| 201| ((png_uint_32)(*((buf) + 1)) << 16) + \ | | | | | | | | | | | | 2825| 201| ((png_uint_32)(*((buf) + 2)) << 8) + \ | | | | | | | | | | | | 2826| 201| ((png_uint_32)(*((buf) + 3)))) | | | | | | | | | | ------------------ | | | | | | | | ------------------ | | | | | | ------------------ | | | | | | 2839| 1.06k| : (png_int_32)png_get_uint_32(buf))) | | | | | | ------------------ | | | | | | | | 322| 864|#define png_get_uint_32 OSS_FUZZ_png_get_uint_32 | | | | | | | | ------------------ | | | | | | | | | | 462| 864|#define OSS_FUZZ_png_get_uint_32(buf) PNG_get_uint_32(buf) | | | | | | | | | | ------------------ | | | | | | | | | | | | 2823| 864| (((png_uint_32)(*(buf)) << 24) + \ | | | | | | | | | | | | 2824| 864| ((png_uint_32)(*((buf) + 1)) << 16) + \ | | | | | | | | | | | | 2825| 864| ((png_uint_32)(*((buf) + 2)) << 8) + \ | | | | | | | | | | | | 2826| 864| ((png_uint_32)(*((buf) + 3)))) | | | | | | | | | | ------------------ | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 2189| 1.06k| X1 = png_get_int_32((png_bytep)buf+5); ------------------ | | 288| 1.06k|#define png_get_int_32 OSS_FUZZ_png_get_int_32 | | ------------------ | | | | 464| 1.06k|#define OSS_FUZZ_png_get_int_32(buf) PNG_get_int_32(buf) | | | | ------------------ | | | | | | 2837| 1.06k| ((png_int_32)((*(buf) & 0x80) \ | | | | | | ------------------ | | | | | | | Branch (2837:18): [True: 244, False: 821] | | | | | | ------------------ | | | | | | 2838| 1.06k| ? -((png_int_32)(((png_get_uint_32(buf)^0xffffffffU)+1U)&0x7fffffffU)) \ | | | | | | ------------------ | | | | | | | | 322| 244|#define png_get_uint_32 OSS_FUZZ_png_get_uint_32 | | | | | | | | ------------------ | | | | | | | | | | 462| 244|#define OSS_FUZZ_png_get_uint_32(buf) PNG_get_uint_32(buf) | | | | | | | | | | ------------------ | | | | | | | | | | | | 2823| 244| (((png_uint_32)(*(buf)) << 24) + \ | | | | | | | | | | | | 2824| 244| ((png_uint_32)(*((buf) + 1)) << 16) + \ | | | | | | | | | | | | 2825| 244| ((png_uint_32)(*((buf) + 2)) << 8) + \ | | | | | | | | | | | | 2826| 244| ((png_uint_32)(*((buf) + 3)))) | | | | | | | | | | ------------------ | | | | | | | | ------------------ | | | | | | ------------------ | | | | | | 2839| 1.06k| : (png_int_32)png_get_uint_32(buf))) | | | | | | ------------------ | | | | | | | | 322| 821|#define png_get_uint_32 OSS_FUZZ_png_get_uint_32 | | | | | | | | ------------------ | | | | | | | | | | 462| 821|#define OSS_FUZZ_png_get_uint_32(buf) PNG_get_uint_32(buf) | | | | | | | | | | ------------------ | | | | | | | | | | | | 2823| 821| (((png_uint_32)(*(buf)) << 24) + \ | | | | | | | | | | | | 2824| 821| ((png_uint_32)(*((buf) + 1)) << 16) + \ | | | | | | | | | | | | 2825| 821| ((png_uint_32)(*((buf) + 2)) << 8) + \ | | | | | | | | | | | | 2826| 821| ((png_uint_32)(*((buf) + 3)))) | | | | | | | | | | ------------------ | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 2190| 1.06k| type = buf[9]; 2191| 1.06k| nparams = buf[10]; 2192| 1.06k| units = buf + 11; 2193| | 2194| 1.06k| png_debug(3, "Checking pCAL equation type and number of parameters"); ------------------ | | 145| 1.06k|# define png_debug(l, m) ((void)0) ------------------ 2195| | /* Check that we have the right number of parameters for known 2196| | * equation types. 2197| | */ 2198| 1.06k| if ((type == PNG_EQUATION_LINEAR && nparams != 2) || ------------------ | | 695| 2.13k|#define PNG_EQUATION_LINEAR 0 /* Linear transformation */ ------------------ | Branch (2198:9): [True: 254, False: 811] | Branch (2198:40): [True: 239, False: 15] ------------------ 2199| 760| (type == PNG_EQUATION_BASE_E && nparams != 3) || ------------------ | | 696| 1.52k|#define PNG_EQUATION_BASE_E 1 /* Exponential base e transform */ ------------------ | Branch (2199:9): [True: 197, False: 563] | Branch (2199:40): [True: 196, False: 1] ------------------ 2200| 564| (type == PNG_EQUATION_ARBITRARY && nparams != 3) || ------------------ | | 697| 1.12k|#define PNG_EQUATION_ARBITRARY 2 /* Arbitrary base exponential transform */ ------------------ | Branch (2200:9): [True: 67, False: 497] | Branch (2200:43): [True: 67, False: 0] ------------------ 2201| 497| (type == PNG_EQUATION_HYPERBOLIC && nparams != 4)) ------------------ | | 698| 994|#define PNG_EQUATION_HYPERBOLIC 3 /* Hyperbolic sine transformation */ ------------------ | Branch (2201:9): [True: 194, False: 303] | Branch (2201:44): [True: 194, False: 0] ------------------ 2202| 696| { 2203| 696| png_chunk_benign_error(png_ptr, "invalid parameter count"); ------------------ | | 238| 696|#define png_chunk_benign_error OSS_FUZZ_png_chunk_benign_error ------------------ 2204| 696| return handled_error; 2205| 696| } 2206| | 2207| 369| else if (type >= PNG_EQUATION_LAST) ------------------ | | 699| 369|#define PNG_EQUATION_LAST 4 /* Not a valid value */ ------------------ | Branch (2207:13): [True: 287, False: 82] ------------------ 2208| 287| { 2209| 287| png_chunk_benign_error(png_ptr, "unrecognized equation type"); ------------------ | | 238| 287|#define png_chunk_benign_error OSS_FUZZ_png_chunk_benign_error ------------------ 2210| 287| } 2211| | 2212| 2.36k| for (buf = units; *buf; buf++) ------------------ | Branch (2212:22): [True: 1.99k, False: 369] ------------------ 2213| 1.99k| /* Empty loop to move past the units string. */ ; 2214| | 2215| 369| png_debug(3, "Allocating pCAL parameters array"); ------------------ | | 145| 369|# define png_debug(l, m) ((void)0) ------------------ 2216| | 2217| 369| params = png_voidcast(png_charpp, png_malloc_warn(png_ptr, ------------------ | | 535| 369|# define png_voidcast(type, value) (value) ------------------ 2218| 369| nparams * (sizeof (png_charp)))); 2219| | 2220| 369| if (params == NULL) ------------------ | Branch (2220:8): [True: 0, False: 369] ------------------ 2221| 0| { 2222| 0| png_chunk_benign_error(png_ptr, "out of memory"); ------------------ | | 238| 0|#define png_chunk_benign_error OSS_FUZZ_png_chunk_benign_error ------------------ 2223| 0| return handled_error; 2224| 0| } 2225| | 2226| | /* Get pointers to the start of each parameter string. */ 2227| 750| for (i = 0; i < nparams; i++) ------------------ | Branch (2227:16): [True: 659, False: 91] ------------------ 2228| 659| { 2229| 659| buf++; /* Skip the null string terminator from previous parameter. */ 2230| | 2231| 659| png_debug1(3, "Reading pCAL parameter %d", i); ------------------ | | 148| 659|# define png_debug1(l, m, p1) ((void)0) ------------------ 2232| | 2233| 1.74k| for (params[i] = (png_charp)buf; buf <= endptr && *buf != 0; buf++) ------------------ | Branch (2233:40): [True: 1.47k, False: 278] | Branch (2233:57): [True: 1.08k, False: 381] ------------------ 2234| 1.08k| /* Empty loop to move past each parameter string */ ; 2235| | 2236| | /* Make sure we haven't run out of data yet */ 2237| 659| if (buf > endptr) ------------------ | Branch (2237:11): [True: 278, False: 381] ------------------ 2238| 278| { 2239| 278| png_free(png_ptr, params); ------------------ | | 253| 278|#define png_free OSS_FUZZ_png_free ------------------ 2240| 278| png_chunk_benign_error(png_ptr, "invalid data"); ------------------ | | 238| 278|#define png_chunk_benign_error OSS_FUZZ_png_chunk_benign_error ------------------ 2241| 278| return handled_error; 2242| 278| } 2243| 659| } 2244| | 2245| 91| png_set_pCAL(png_ptr, info_ptr, (png_charp)buffer, X0, X1, type, nparams, ------------------ | | 410| 91|#define png_set_pCAL OSS_FUZZ_png_set_pCAL ------------------ 2246| 91| (png_charp)units, params); 2247| | 2248| | /* TODO: BUG: png_set_pCAL calls png_chunk_report which, in this case, calls 2249| | * png_benign_error and that can error out. 2250| | * 2251| | * png_read_buffer needs to be allocated with space for both nparams and the 2252| | * parameter strings. Not hard to do. 2253| | */ 2254| 91| png_free(png_ptr, params); ------------------ | | 253| 91|#define png_free OSS_FUZZ_png_free ------------------ 2255| 91| return handled_ok; 2256| 369|} pngrutil.c:png_handle_pHYs: 2088| 539|{ 2089| 539| png_byte buf[9]; 2090| 539| png_uint_32 res_x, res_y; 2091| 539| int unit_type; 2092| | 2093| 539| png_debug(1, "in png_handle_pHYs"); ------------------ | | 145| 539|# define png_debug(l, m) ((void)0) ------------------ 2094| | 2095| 539| png_crc_read(png_ptr, buf, 9); ------------------ | | 24| 539|#define png_crc_read OSS_FUZZ_png_crc_read ------------------ 2096| | 2097| 539| if (png_crc_finish(png_ptr, 0) != 0) ------------------ | | 25| 539|#define png_crc_finish OSS_FUZZ_png_crc_finish ------------------ | Branch (2097:8): [True: 530, False: 9] ------------------ 2098| 530| return handled_error; 2099| | 2100| 9| res_x = png_get_uint_32(buf); ------------------ | | 322| 9|#define png_get_uint_32 OSS_FUZZ_png_get_uint_32 | | ------------------ | | | | 462| 9|#define OSS_FUZZ_png_get_uint_32(buf) PNG_get_uint_32(buf) | | | | ------------------ | | | | | | 2823| 9| (((png_uint_32)(*(buf)) << 24) + \ | | | | | | 2824| 9| ((png_uint_32)(*((buf) + 1)) << 16) + \ | | | | | | 2825| 9| ((png_uint_32)(*((buf) + 2)) << 8) + \ | | | | | | 2826| 9| ((png_uint_32)(*((buf) + 3)))) | | | | ------------------ | | ------------------ ------------------ 2101| 9| res_y = png_get_uint_32(buf + 4); ------------------ | | 322| 9|#define png_get_uint_32 OSS_FUZZ_png_get_uint_32 | | ------------------ | | | | 462| 9|#define OSS_FUZZ_png_get_uint_32(buf) PNG_get_uint_32(buf) | | | | ------------------ | | | | | | 2823| 9| (((png_uint_32)(*(buf)) << 24) + \ | | | | | | 2824| 9| ((png_uint_32)(*((buf) + 1)) << 16) + \ | | | | | | 2825| 9| ((png_uint_32)(*((buf) + 2)) << 8) + \ | | | | | | 2826| 9| ((png_uint_32)(*((buf) + 3)))) | | | | ------------------ | | ------------------ ------------------ 2102| 9| unit_type = buf[8]; 2103| 9| png_set_pHYs(png_ptr, info_ptr, res_x, res_y, unit_type); ------------------ | | 411| 9|#define png_set_pHYs OSS_FUZZ_png_set_pHYs ------------------ 2104| 9| return handled_ok; 2105| 0| PNG_UNUSED(length) ------------------ | | 479| 0|# define PNG_UNUSED(param) (void)param; ------------------ 2106| 0|} pngrutil.c:png_handle_sBIT: 1142| 904|{ 1143| 904| unsigned int truelen, i; 1144| 904| png_byte sample_depth; 1145| 904| png_byte buf[4]; 1146| | 1147| 904| png_debug(1, "in png_handle_sBIT"); ------------------ | | 145| 904|# define png_debug(l, m) ((void)0) ------------------ 1148| | 1149| 904| if (png_ptr->color_type == PNG_COLOR_TYPE_PALETTE) ------------------ | | 667| 904|#define PNG_COLOR_TYPE_PALETTE (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_PALETTE) | | ------------------ | | | | 662| 904|#define PNG_COLOR_MASK_COLOR 2 | | ------------------ | | #define PNG_COLOR_TYPE_PALETTE (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_PALETTE) | | ------------------ | | | | 661| 904|#define PNG_COLOR_MASK_PALETTE 1 | | ------------------ ------------------ | Branch (1149:8): [True: 71, False: 833] ------------------ 1150| 71| { 1151| 71| truelen = 3; 1152| 71| sample_depth = 8; 1153| 71| } 1154| | 1155| 833| else 1156| 833| { 1157| 833| truelen = png_ptr->channels; 1158| 833| sample_depth = png_ptr->bit_depth; 1159| 833| } 1160| | 1161| 904| if (length != truelen) ------------------ | Branch (1161:8): [True: 115, False: 789] ------------------ 1162| 115| { 1163| 115| png_crc_finish(png_ptr, length); ------------------ | | 25| 115|#define png_crc_finish OSS_FUZZ_png_crc_finish ------------------ 1164| 115| png_chunk_benign_error(png_ptr, "bad length"); ------------------ | | 238| 115|#define png_chunk_benign_error OSS_FUZZ_png_chunk_benign_error ------------------ 1165| 115| return handled_error; 1166| 115| } 1167| | 1168| 789| buf[0] = buf[1] = buf[2] = buf[3] = sample_depth; 1169| 789| png_crc_read(png_ptr, buf, truelen); ------------------ | | 24| 789|#define png_crc_read OSS_FUZZ_png_crc_read ------------------ 1170| | 1171| 789| if (png_crc_finish(png_ptr, 0) != 0) ------------------ | | 25| 789|#define png_crc_finish OSS_FUZZ_png_crc_finish ------------------ | Branch (1171:8): [True: 426, False: 363] ------------------ 1172| 426| return handled_error; 1173| | 1174| 718| for (i=0; i sample_depth) ------------------ | Branch (1176:11): [True: 72, False: 629] | Branch (1176:26): [True: 274, False: 355] ------------------ 1177| 346| { 1178| 346| png_chunk_benign_error(png_ptr, "invalid"); ------------------ | | 238| 346|#define png_chunk_benign_error OSS_FUZZ_png_chunk_benign_error ------------------ 1179| 346| return handled_error; 1180| 346| } 1181| 701| } 1182| | 1183| 17| if ((png_ptr->color_type & PNG_COLOR_MASK_COLOR) != 0) ------------------ | | 662| 17|#define PNG_COLOR_MASK_COLOR 2 ------------------ | Branch (1183:8): [True: 7, False: 10] ------------------ 1184| 7| { 1185| 7| png_ptr->sig_bit.red = buf[0]; 1186| 7| png_ptr->sig_bit.green = buf[1]; 1187| 7| png_ptr->sig_bit.blue = buf[2]; 1188| 7| png_ptr->sig_bit.alpha = buf[3]; 1189| 7| } 1190| | 1191| 10| else /* grayscale */ 1192| 10| { 1193| 10| png_ptr->sig_bit.gray = buf[0]; 1194| 10| png_ptr->sig_bit.red = buf[0]; 1195| 10| png_ptr->sig_bit.green = buf[0]; 1196| 10| png_ptr->sig_bit.blue = buf[0]; 1197| 10| png_ptr->sig_bit.alpha = buf[1]; 1198| 10| } 1199| | 1200| 17| png_set_sBIT(png_ptr, info_ptr, &(png_ptr->sig_bit)); ------------------ | | 424| 17|#define png_set_sBIT OSS_FUZZ_png_set_sBIT ------------------ 1201| 17| return handled_ok; 1202| 363|} pngrutil.c:png_handle_sCAL: 2265| 3.65k|{ 2266| 3.65k| png_bytep buffer; 2267| 3.65k| size_t i; 2268| 3.65k| int state; 2269| | 2270| 3.65k| png_debug(1, "in png_handle_sCAL"); ------------------ | | 145| 3.65k|# define png_debug(l, m) ((void)0) ------------------ 2271| 3.65k| png_debug1(2, "Allocating and reading sCAL chunk data (%u bytes)", ------------------ | | 148| 3.65k|# define png_debug1(l, m, p1) ((void)0) ------------------ 2272| 3.65k| length + 1); 2273| | 2274| 3.65k| buffer = png_read_buffer(png_ptr, length+1); 2275| | 2276| 3.65k| if (buffer == NULL) ------------------ | Branch (2276:8): [True: 1, False: 3.65k] ------------------ 2277| 1| { 2278| 1| png_crc_finish(png_ptr, length); ------------------ | | 25| 1|#define png_crc_finish OSS_FUZZ_png_crc_finish ------------------ 2279| 1| png_chunk_benign_error(png_ptr, "out of memory"); ------------------ | | 238| 1|#define png_chunk_benign_error OSS_FUZZ_png_chunk_benign_error ------------------ 2280| 1| return handled_error; 2281| 1| } 2282| | 2283| 3.65k| png_crc_read(png_ptr, buffer, length); ------------------ | | 24| 3.65k|#define png_crc_read OSS_FUZZ_png_crc_read ------------------ 2284| 3.65k| buffer[length] = 0; /* Null terminate the last string */ 2285| | 2286| 3.65k| if (png_crc_finish(png_ptr, 0) != 0) ------------------ | | 25| 3.65k|#define png_crc_finish OSS_FUZZ_png_crc_finish ------------------ | Branch (2286:8): [True: 1.27k, False: 2.37k] ------------------ 2287| 1.27k| return handled_error; 2288| | 2289| | /* Validate the unit. */ 2290| 2.37k| if (buffer[0] != 1 && buffer[0] != 2) ------------------ | Branch (2290:8): [True: 271, False: 2.10k] | Branch (2290:26): [True: 205, False: 66] ------------------ 2291| 205| { 2292| 205| png_chunk_benign_error(png_ptr, "invalid unit"); ------------------ | | 238| 205|#define png_chunk_benign_error OSS_FUZZ_png_chunk_benign_error ------------------ 2293| 205| return handled_error; 2294| 205| } 2295| | 2296| | /* Validate the ASCII numbers, need two ASCII numbers separated by 2297| | * a '\0' and they need to fit exactly in the chunk data. 2298| | */ 2299| 2.16k| i = 1; 2300| 2.16k| state = 0; 2301| | 2302| 2.16k| if (png_check_fp_number((png_const_charp)buffer, length, &state, &i) == 0 || ------------------ | | 86| 2.16k|#define png_check_fp_number OSS_FUZZ_png_check_fp_number ------------------ | Branch (2302:8): [True: 846, False: 1.32k] ------------------ 2303| 1.32k| i >= length || buffer[i++] != 0) ------------------ | Branch (2303:8): [True: 272, False: 1.05k] | Branch (2303:23): [True: 286, False: 765] ------------------ 2304| 1.30k| png_chunk_benign_error(png_ptr, "bad width format"); ------------------ | | 238| 1.30k|#define png_chunk_benign_error OSS_FUZZ_png_chunk_benign_error ------------------ 2305| | 2306| 862| else if (PNG_FP_IS_POSITIVE(state) == 0) ------------------ | | 2153| 862|#define PNG_FP_IS_POSITIVE(state) (((state) & PNG_FP_NZ_MASK) == PNG_FP_Z_MASK) | | ------------------ | | | | 2147| 862|#define PNG_FP_NZ_MASK (PNG_FP_SAW_DIGIT | PNG_FP_NEGATIVE | PNG_FP_NONZERO) | | | | ------------------ | | | | | | 2119| 862|#define PNG_FP_SAW_DIGIT 8 /* Saw a digit in current state */ | | | | ------------------ | | | | #define PNG_FP_NZ_MASK (PNG_FP_SAW_DIGIT | PNG_FP_NEGATIVE | PNG_FP_NONZERO) | | | | ------------------ | | | | | | 2127| 862|#define PNG_FP_NEGATIVE 128 /* A negative number, including "-0" */ | | | | ------------------ | | | | #define PNG_FP_NZ_MASK (PNG_FP_SAW_DIGIT | PNG_FP_NEGATIVE | PNG_FP_NONZERO) | | | | ------------------ | | | | | | 2128| 862|#define PNG_FP_NONZERO 256 /* A non-zero value */ | | | | ------------------ | | ------------------ | | #define PNG_FP_IS_POSITIVE(state) (((state) & PNG_FP_NZ_MASK) == PNG_FP_Z_MASK) | | ------------------ | | | | 2149| 862|#define PNG_FP_Z_MASK (PNG_FP_SAW_DIGIT | PNG_FP_NONZERO) | | | | ------------------ | | | | | | 2119| 862|#define PNG_FP_SAW_DIGIT 8 /* Saw a digit in current state */ | | | | ------------------ | | | | #define PNG_FP_Z_MASK (PNG_FP_SAW_DIGIT | PNG_FP_NONZERO) | | | | ------------------ | | | | | | 2128| 862|#define PNG_FP_NONZERO 256 /* A non-zero value */ | | | | ------------------ | | ------------------ ------------------ | Branch (2306:13): [True: 66, False: 796] ------------------ 2307| 66| png_chunk_benign_error(png_ptr, "non-positive width"); ------------------ | | 238| 66|#define png_chunk_benign_error OSS_FUZZ_png_chunk_benign_error ------------------ 2308| | 2309| 796| else 2310| 796| { 2311| 796| size_t heighti = i; 2312| | 2313| 796| state = 0; 2314| 796| if (png_check_fp_number((png_const_charp)buffer, length, ------------------ | | 86| 796|#define png_check_fp_number OSS_FUZZ_png_check_fp_number ------------------ | Branch (2314:11): [True: 355, False: 441] ------------------ 2315| 796| &state, &i) == 0 || i != length) ------------------ | Branch (2315:31): [True: 435, False: 6] ------------------ 2316| 693| png_chunk_benign_error(png_ptr, "bad height format"); ------------------ | | 238| 693|#define png_chunk_benign_error OSS_FUZZ_png_chunk_benign_error ------------------ 2317| | 2318| 103| else if (PNG_FP_IS_POSITIVE(state) == 0) ------------------ | | 2153| 103|#define PNG_FP_IS_POSITIVE(state) (((state) & PNG_FP_NZ_MASK) == PNG_FP_Z_MASK) | | ------------------ | | | | 2147| 103|#define PNG_FP_NZ_MASK (PNG_FP_SAW_DIGIT | PNG_FP_NEGATIVE | PNG_FP_NONZERO) | | | | ------------------ | | | | | | 2119| 103|#define PNG_FP_SAW_DIGIT 8 /* Saw a digit in current state */ | | | | ------------------ | | | | #define PNG_FP_NZ_MASK (PNG_FP_SAW_DIGIT | PNG_FP_NEGATIVE | PNG_FP_NONZERO) | | | | ------------------ | | | | | | 2127| 103|#define PNG_FP_NEGATIVE 128 /* A negative number, including "-0" */ | | | | ------------------ | | | | #define PNG_FP_NZ_MASK (PNG_FP_SAW_DIGIT | PNG_FP_NEGATIVE | PNG_FP_NONZERO) | | | | ------------------ | | | | | | 2128| 103|#define PNG_FP_NONZERO 256 /* A non-zero value */ | | | | ------------------ | | ------------------ | | #define PNG_FP_IS_POSITIVE(state) (((state) & PNG_FP_NZ_MASK) == PNG_FP_Z_MASK) | | ------------------ | | | | 2149| 103|#define PNG_FP_Z_MASK (PNG_FP_SAW_DIGIT | PNG_FP_NONZERO) | | | | ------------------ | | | | | | 2119| 103|#define PNG_FP_SAW_DIGIT 8 /* Saw a digit in current state */ | | | | ------------------ | | | | #define PNG_FP_Z_MASK (PNG_FP_SAW_DIGIT | PNG_FP_NONZERO) | | | | ------------------ | | | | | | 2128| 103|#define PNG_FP_NONZERO 256 /* A non-zero value */ | | | | ------------------ | | ------------------ ------------------ | Branch (2318:16): [True: 0, False: 103] ------------------ 2319| 0| png_chunk_benign_error(png_ptr, "non-positive height"); ------------------ | | 238| 0|#define png_chunk_benign_error OSS_FUZZ_png_chunk_benign_error ------------------ 2320| | 2321| 103| else 2322| 103| { 2323| | /* This is the (only) success case. */ 2324| 103| png_set_sCAL_s(png_ptr, info_ptr, buffer[0], ------------------ | | 427| 103|#define png_set_sCAL_s OSS_FUZZ_png_set_sCAL_s ------------------ 2325| 103| (png_charp)buffer+1, (png_charp)buffer+heighti); 2326| 103| return handled_ok; 2327| 103| } 2328| 796| } 2329| | 2330| 2.06k| return handled_error; 2331| 2.16k|} pngrutil.c:png_handle_sPLT: 1553| 16.3k|{ 1554| 16.3k| png_bytep buffer; 1555| 16.3k| png_bytep entry_start; 1556| 16.3k| png_sPLT_t new_palette; 1557| 16.3k| png_sPLT_entryp pp; 1558| 16.3k| png_uint_32 data_length; 1559| 16.3k| int entry_size, i; 1560| 16.3k| png_uint_32 skip = 0; 1561| 16.3k| png_uint_32 dl; 1562| 16.3k| size_t max_dl; 1563| | 1564| 16.3k| png_debug(1, "in png_handle_sPLT"); ------------------ | | 145| 16.3k|# define png_debug(l, m) ((void)0) ------------------ 1565| | 1566| 16.3k|#ifdef PNG_USER_LIMITS_SUPPORTED 1567| 16.3k| if (png_ptr->user_chunk_cache_max != 0) ------------------ | Branch (1567:8): [True: 16.3k, False: 0] ------------------ 1568| 16.3k| { 1569| 16.3k| if (png_ptr->user_chunk_cache_max == 1) ------------------ | Branch (1569:11): [True: 208, False: 16.1k] ------------------ 1570| 208| { 1571| 208| png_crc_finish(png_ptr, length); ------------------ | | 25| 208|#define png_crc_finish OSS_FUZZ_png_crc_finish ------------------ 1572| 208| return handled_error; 1573| 208| } 1574| | 1575| 16.1k| if (--png_ptr->user_chunk_cache_max == 1) ------------------ | Branch (1575:11): [True: 9, False: 16.1k] ------------------ 1576| 9| { 1577| 9| png_warning(png_ptr, "No space in chunk cache for sPLT"); ------------------ | | 450| 9|#define png_warning OSS_FUZZ_png_warning ------------------ 1578| 9| png_crc_finish(png_ptr, length); ------------------ | | 25| 9|#define png_crc_finish OSS_FUZZ_png_crc_finish ------------------ 1579| 9| return handled_error; 1580| 9| } 1581| 16.1k| } 1582| 16.1k|#endif 1583| | 1584| 16.1k| buffer = png_read_buffer(png_ptr, length+1); 1585| 16.1k| if (buffer == NULL) ------------------ | Branch (1585:8): [True: 21, False: 16.0k] ------------------ 1586| 21| { 1587| 21| png_crc_finish(png_ptr, length); ------------------ | | 25| 21|#define png_crc_finish OSS_FUZZ_png_crc_finish ------------------ 1588| 21| png_chunk_benign_error(png_ptr, "out of memory"); ------------------ | | 238| 21|#define png_chunk_benign_error OSS_FUZZ_png_chunk_benign_error ------------------ 1589| 21| return handled_error; 1590| 21| } 1591| | 1592| | 1593| | /* WARNING: this may break if size_t is less than 32 bits; it is assumed 1594| | * that the PNG_MAX_MALLOC_64K test is enabled in this case, but this is a 1595| | * potential breakage point if the types in pngconf.h aren't exactly right. 1596| | */ 1597| 16.0k| png_crc_read(png_ptr, buffer, length); ------------------ | | 24| 16.0k|#define png_crc_read OSS_FUZZ_png_crc_read ------------------ 1598| | 1599| 16.0k| if (png_crc_finish(png_ptr, skip) != 0) ------------------ | | 25| 16.0k|#define png_crc_finish OSS_FUZZ_png_crc_finish ------------------ | Branch (1599:8): [True: 3.70k, False: 12.3k] ------------------ 1600| 3.70k| return handled_error; 1601| | 1602| 12.3k| buffer[length] = 0; 1603| | 1604| 69.0k| for (entry_start = buffer; *entry_start; entry_start++) ------------------ | Branch (1604:31): [True: 56.6k, False: 12.3k] ------------------ 1605| 56.6k| /* Empty loop to find end of name */ ; 1606| | 1607| 12.3k| ++entry_start; 1608| | 1609| | /* A sample depth should follow the separator, and we should be on it */ 1610| 12.3k| if (length < 2U || entry_start > buffer + (length - 2U)) ------------------ | Branch (1610:8): [True: 94, False: 12.2k] | Branch (1610:23): [True: 10.9k, False: 1.37k] ------------------ 1611| 10.9k| { 1612| 10.9k| png_warning(png_ptr, "malformed sPLT chunk"); ------------------ | | 450| 10.9k|#define png_warning OSS_FUZZ_png_warning ------------------ 1613| 10.9k| return handled_error; 1614| 10.9k| } 1615| | 1616| 1.46k| new_palette.depth = *entry_start++; 1617| 1.46k| entry_size = (new_palette.depth == 8 ? 6 : 10); ------------------ | Branch (1617:18): [True: 1, False: 1.46k] ------------------ 1618| | /* This must fit in a png_uint_32 because it is derived from the original 1619| | * chunk data length. 1620| | */ 1621| 1.46k| data_length = length - (png_uint_32)(entry_start - buffer); 1622| | 1623| | /* Integrity-check the data length */ 1624| 1.46k| if ((data_length % (unsigned int)entry_size) != 0) ------------------ | Branch (1624:8): [True: 199, False: 1.26k] ------------------ 1625| 199| { 1626| 199| png_warning(png_ptr, "sPLT chunk has bad length"); ------------------ | | 450| 199|#define png_warning OSS_FUZZ_png_warning ------------------ 1627| 199| return handled_error; 1628| 199| } 1629| | 1630| 1.26k| dl = (png_uint_32)(data_length / (unsigned int)entry_size); 1631| 1.26k| max_dl = PNG_SIZE_MAX / (sizeof (png_sPLT_entry)); ------------------ | | 649| 1.26k|#define PNG_SIZE_MAX ((size_t)(-1)) ------------------ 1632| | 1633| 1.26k| if (dl > max_dl) ------------------ | Branch (1633:8): [True: 0, False: 1.26k] ------------------ 1634| 0| { 1635| 0| png_warning(png_ptr, "sPLT chunk too long"); ------------------ | | 450| 0|#define png_warning OSS_FUZZ_png_warning ------------------ 1636| 0| return handled_error; 1637| 0| } 1638| | 1639| 1.26k| new_palette.nentries = (png_int_32)(data_length / (unsigned int)entry_size); 1640| | 1641| 1.26k| new_palette.entries = (png_sPLT_entryp)png_malloc_warn(png_ptr, ------------------ | | 349| 1.26k|#define png_malloc_warn OSS_FUZZ_png_malloc_warn ------------------ 1642| 1.26k| (png_alloc_size_t) new_palette.nentries * (sizeof (png_sPLT_entry))); 1643| | 1644| 1.26k| if (new_palette.entries == NULL) ------------------ | Branch (1644:8): [True: 0, False: 1.26k] ------------------ 1645| 0| { 1646| 0| png_warning(png_ptr, "sPLT chunk requires too much memory"); ------------------ | | 450| 0|#define png_warning OSS_FUZZ_png_warning ------------------ 1647| 0| return handled_error; 1648| 0| } 1649| | 1650| 4.82k| for (i = 0; i < new_palette.nentries; i++) ------------------ | Branch (1650:16): [True: 3.56k, False: 1.26k] ------------------ 1651| 3.56k| { 1652| 3.56k| pp = new_palette.entries + i; 1653| | 1654| 3.56k| if (new_palette.depth == 8) ------------------ | Branch (1654:11): [True: 0, False: 3.56k] ------------------ 1655| 0| { 1656| 0| pp->red = *entry_start++; 1657| 0| pp->green = *entry_start++; 1658| 0| pp->blue = *entry_start++; 1659| 0| pp->alpha = *entry_start++; 1660| 0| } 1661| | 1662| 3.56k| else 1663| 3.56k| { 1664| 3.56k| pp->red = png_get_uint_16(entry_start); entry_start += 2; ------------------ | | 320| 3.56k|#define png_get_uint_16 OSS_FUZZ_png_get_uint_16 | | ------------------ | | | | 463| 3.56k|#define OSS_FUZZ_png_get_uint_16(buf) PNG_get_uint_16(buf) | | | | ------------------ | | | | | | 2832| 3.56k| ((png_uint_16) \ | | | | | | 2833| 3.56k| (((unsigned int)(*(buf)) << 8) + \ | | | | | | 2834| 3.56k| ((unsigned int)(*((buf) + 1))))) | | | | ------------------ | | ------------------ ------------------ 1665| 3.56k| pp->green = png_get_uint_16(entry_start); entry_start += 2; ------------------ | | 320| 3.56k|#define png_get_uint_16 OSS_FUZZ_png_get_uint_16 | | ------------------ | | | | 463| 3.56k|#define OSS_FUZZ_png_get_uint_16(buf) PNG_get_uint_16(buf) | | | | ------------------ | | | | | | 2832| 3.56k| ((png_uint_16) \ | | | | | | 2833| 3.56k| (((unsigned int)(*(buf)) << 8) + \ | | | | | | 2834| 3.56k| ((unsigned int)(*((buf) + 1))))) | | | | ------------------ | | ------------------ ------------------ 1666| 3.56k| pp->blue = png_get_uint_16(entry_start); entry_start += 2; ------------------ | | 320| 3.56k|#define png_get_uint_16 OSS_FUZZ_png_get_uint_16 | | ------------------ | | | | 463| 3.56k|#define OSS_FUZZ_png_get_uint_16(buf) PNG_get_uint_16(buf) | | | | ------------------ | | | | | | 2832| 3.56k| ((png_uint_16) \ | | | | | | 2833| 3.56k| (((unsigned int)(*(buf)) << 8) + \ | | | | | | 2834| 3.56k| ((unsigned int)(*((buf) + 1))))) | | | | ------------------ | | ------------------ ------------------ 1667| 3.56k| pp->alpha = png_get_uint_16(entry_start); entry_start += 2; ------------------ | | 320| 3.56k|#define png_get_uint_16 OSS_FUZZ_png_get_uint_16 | | ------------------ | | | | 463| 3.56k|#define OSS_FUZZ_png_get_uint_16(buf) PNG_get_uint_16(buf) | | | | ------------------ | | | | | | 2832| 3.56k| ((png_uint_16) \ | | | | | | 2833| 3.56k| (((unsigned int)(*(buf)) << 8) + \ | | | | | | 2834| 3.56k| ((unsigned int)(*((buf) + 1))))) | | | | ------------------ | | ------------------ ------------------ 1668| 3.56k| } 1669| | 1670| 3.56k| pp->frequency = png_get_uint_16(entry_start); entry_start += 2; ------------------ | | 320| 3.56k|#define png_get_uint_16 OSS_FUZZ_png_get_uint_16 | | ------------------ | | | | 463| 3.56k|#define OSS_FUZZ_png_get_uint_16(buf) PNG_get_uint_16(buf) | | | | ------------------ | | | | | | 2832| 3.56k| ((png_uint_16) \ | | | | | | 2833| 3.56k| (((unsigned int)(*(buf)) << 8) + \ | | | | | | 2834| 3.56k| ((unsigned int)(*((buf) + 1))))) | | | | ------------------ | | ------------------ ------------------ 1671| 3.56k| } 1672| | 1673| | /* Discard all chunk data except the name and stash that */ 1674| 1.26k| new_palette.name = (png_charp)buffer; 1675| | 1676| 1.26k| png_set_sPLT(png_ptr, info_ptr, &new_palette, 1); ------------------ | | 428| 1.26k|#define png_set_sPLT OSS_FUZZ_png_set_sPLT ------------------ 1677| | 1678| 1.26k| png_free(png_ptr, new_palette.entries); ------------------ | | 253| 1.26k|#define png_free OSS_FUZZ_png_free ------------------ 1679| 1.26k| return handled_ok; 1680| 1.26k|} pngrutil.c:png_handle_sRGB: 1283| 1.43k|{ 1284| 1.43k| png_byte intent; 1285| | 1286| 1.43k| png_debug(1, "in png_handle_sRGB"); ------------------ | | 145| 1.43k|# define png_debug(l, m) ((void)0) ------------------ 1287| | 1288| 1.43k| png_crc_read(png_ptr, &intent, 1); ------------------ | | 24| 1.43k|#define png_crc_read OSS_FUZZ_png_crc_read ------------------ 1289| | 1290| 1.43k| if (png_crc_finish(png_ptr, 0) != 0) ------------------ | | 25| 1.43k|#define png_crc_finish OSS_FUZZ_png_crc_finish ------------------ | Branch (1290:8): [True: 736, False: 695] ------------------ 1291| 736| return handled_error; 1292| | 1293| | /* This checks the range of the "rendering intent" because it is specified in 1294| | * the PNG spec itself; the "reserved" values will result in the chunk not 1295| | * being accepted, just as they do with the various "reserved" values in 1296| | * IHDR. 1297| | */ 1298| 695| if (intent > 3/*PNGv3 spec*/) ------------------ | Branch (1298:8): [True: 266, False: 429] ------------------ 1299| 266| { 1300| 266| png_chunk_benign_error(png_ptr, "invalid"); ------------------ | | 238| 266|#define png_chunk_benign_error OSS_FUZZ_png_chunk_benign_error ------------------ 1301| 266| return handled_error; 1302| 266| } 1303| | 1304| 429| png_set_sRGB(png_ptr, info_ptr, intent); ------------------ | | 429| 429|#define png_set_sRGB OSS_FUZZ_png_set_sRGB ------------------ 1305| | /* NOTE: png_struct::chromaticities is not set here because the RGB to gray 1306| | * coefficients are known without a need for the chromaticities. 1307| | */ 1308| | 1309| 429|#ifdef PNG_READ_GAMMA_SUPPORTED 1310| | /* PNGv3: chunk precedence for gamma is cICP, [iCCP], sRGB, gAMA. iCCP is 1311| | * not supported by libpng so the only requirement is to check for cICP 1312| | * setting the gamma (this is NYI, but this check is safe.) 1313| | */ 1314| 429| if (!png_has_chunk(png_ptr, cICP) || png_ptr->chunk_gamma == 0) ------------------ | | 194| 429| png_file_has_chunk(png_ptr, PNG_INDEX_ ## cHNK) | | ------------------ | | | | 115| 858| (((png_ptr)->chunks & png_chunk_flag_from_index(i)) != 0) | | | | ------------------ | | | | | | 108| 429|#define png_chunk_flag_from_index(i) (0x80000000U >> (31 - (i))) | | | | ------------------ | | ------------------ ------------------ | Branch (1314:11): [True: 427, False: 2] | Branch (1314:44): [True: 1, False: 1] ------------------ 1315| 423| png_ptr->chunk_gamma = PNG_GAMMA_sRGB_INVERSE; ------------------ | | 1000| 423|#define PNG_GAMMA_sRGB_INVERSE 45455 ------------------ 1316| 429|#endif /*READ_GAMMA*/ 1317| | 1318| 429| return handled_ok; 1319| 0| PNG_UNUSED(length) ------------------ | | 479| 0|# define PNG_UNUSED(param) (void)param; ------------------ 1320| 0|} pngrutil.c:png_handle_tEXt: 2376| 27.7k|{ 2377| 27.7k| png_text text_info; 2378| 27.7k| png_bytep buffer; 2379| 27.7k| png_charp key; 2380| 27.7k| png_charp text; 2381| 27.7k| png_uint_32 skip = 0; 2382| | 2383| 27.7k| png_debug(1, "in png_handle_tEXt"); ------------------ | | 145| 27.7k|# define png_debug(l, m) ((void)0) ------------------ 2384| | 2385| 27.7k|#ifdef PNG_USER_LIMITS_SUPPORTED 2386| 27.7k| if (png_ptr->user_chunk_cache_max != 0) ------------------ | Branch (2386:8): [True: 27.7k, False: 0] ------------------ 2387| 27.7k| { 2388| 27.7k| if (png_ptr->user_chunk_cache_max == 1) ------------------ | Branch (2388:11): [True: 200, False: 27.5k] ------------------ 2389| 200| { 2390| 200| png_crc_finish(png_ptr, length); ------------------ | | 25| 200|#define png_crc_finish OSS_FUZZ_png_crc_finish ------------------ 2391| 200| return handled_error; 2392| 200| } 2393| | 2394| 27.5k| if (--png_ptr->user_chunk_cache_max == 1) ------------------ | Branch (2394:11): [True: 8, False: 27.5k] ------------------ 2395| 8| { 2396| 8| png_crc_finish(png_ptr, length); ------------------ | | 25| 8|#define png_crc_finish OSS_FUZZ_png_crc_finish ------------------ 2397| 8| png_chunk_benign_error(png_ptr, "no space in chunk cache"); ------------------ | | 238| 8|#define png_chunk_benign_error OSS_FUZZ_png_chunk_benign_error ------------------ 2398| 8| return handled_error; 2399| 8| } 2400| 27.5k| } 2401| 27.5k|#endif 2402| | 2403| 27.5k| buffer = png_read_buffer(png_ptr, length+1); 2404| | 2405| 27.5k| if (buffer == NULL) ------------------ | Branch (2405:8): [True: 19, False: 27.5k] ------------------ 2406| 19| { 2407| 19| png_crc_finish(png_ptr, length); ------------------ | | 25| 19|#define png_crc_finish OSS_FUZZ_png_crc_finish ------------------ 2408| 19| png_chunk_benign_error(png_ptr, "out of memory"); ------------------ | | 238| 19|#define png_chunk_benign_error OSS_FUZZ_png_chunk_benign_error ------------------ 2409| 19| return handled_error; 2410| 19| } 2411| | 2412| 27.5k| png_crc_read(png_ptr, buffer, length); ------------------ | | 24| 27.5k|#define png_crc_read OSS_FUZZ_png_crc_read ------------------ 2413| | 2414| 27.5k| if (png_crc_finish(png_ptr, skip) != 0) ------------------ | | 25| 27.5k|#define png_crc_finish OSS_FUZZ_png_crc_finish ------------------ | Branch (2414:8): [True: 15.6k, False: 11.9k] ------------------ 2415| 15.6k| return handled_error; 2416| | 2417| 11.9k| key = (png_charp)buffer; 2418| 11.9k| key[length] = 0; 2419| | 2420| 17.6k| for (text = key; *text; text++) ------------------ | Branch (2420:21): [True: 5.69k, False: 11.9k] ------------------ 2421| 5.69k| /* Empty loop to find end of key */ ; 2422| | 2423| 11.9k| if (text != key + length) ------------------ | Branch (2423:8): [True: 10.9k, False: 937] ------------------ 2424| 10.9k| text++; 2425| | 2426| 11.9k| text_info.compression = PNG_TEXT_COMPRESSION_NONE; ------------------ | | 586| 11.9k|#define PNG_TEXT_COMPRESSION_NONE -1 ------------------ 2427| 11.9k| text_info.key = key; 2428| 11.9k| text_info.lang = NULL; 2429| 11.9k| text_info.lang_key = NULL; 2430| 11.9k| text_info.itxt_length = 0; 2431| 11.9k| text_info.text = text; 2432| 11.9k| text_info.text_length = strlen(text); 2433| | 2434| 11.9k| if (png_set_text_2(png_ptr, info_ptr, &text_info, 1) == 0) ------------------ | | 31| 11.9k|#define png_set_text_2 OSS_FUZZ_png_set_text_2 ------------------ | Branch (2434:8): [True: 11.8k, False: 76] ------------------ 2435| 11.8k| return handled_ok; 2436| | 2437| 76| png_chunk_benign_error(png_ptr, "out of memory"); ------------------ | | 238| 76|#define png_chunk_benign_error OSS_FUZZ_png_chunk_benign_error ------------------ 2438| 76| return handled_error; 2439| 11.9k|} pngrutil.c:png_handle_tIME: 2339| 434|{ 2340| 434| png_byte buf[7]; 2341| 434| png_time mod_time; 2342| | 2343| 434| png_debug(1, "in png_handle_tIME"); ------------------ | | 145| 434|# define png_debug(l, m) ((void)0) ------------------ 2344| | 2345| | /* TODO: what is this doing here? It should be happened in pngread.c and 2346| | * pngpread.c, although it could be moved to png_handle_chunk below and 2347| | * thereby avoid some code duplication. 2348| | */ 2349| 434| if ((png_ptr->mode & PNG_HAVE_IDAT) != 0) ------------------ | | 642| 434|#define PNG_HAVE_IDAT 0x04U ------------------ | Branch (2349:8): [True: 0, False: 434] ------------------ 2350| 0| png_ptr->mode |= PNG_AFTER_IDAT; ------------------ | | 644| 0|#define PNG_AFTER_IDAT 0x08 ------------------ 2351| | 2352| 434| png_crc_read(png_ptr, buf, 7); ------------------ | | 24| 434|#define png_crc_read OSS_FUZZ_png_crc_read ------------------ 2353| | 2354| 434| if (png_crc_finish(png_ptr, 0) != 0) ------------------ | | 25| 434|#define png_crc_finish OSS_FUZZ_png_crc_finish ------------------ | Branch (2354:8): [True: 415, False: 19] ------------------ 2355| 415| return handled_error; 2356| | 2357| 19| mod_time.second = buf[6]; 2358| 19| mod_time.minute = buf[5]; 2359| 19| mod_time.hour = buf[4]; 2360| 19| mod_time.day = buf[3]; 2361| 19| mod_time.month = buf[2]; 2362| 19| mod_time.year = png_get_uint_16(buf); ------------------ | | 320| 19|#define png_get_uint_16 OSS_FUZZ_png_get_uint_16 | | ------------------ | | | | 463| 19|#define OSS_FUZZ_png_get_uint_16(buf) PNG_get_uint_16(buf) | | | | ------------------ | | | | | | 2832| 19| ((png_uint_16) \ | | | | | | 2833| 19| (((unsigned int)(*(buf)) << 8) + \ | | | | | | 2834| 19| ((unsigned int)(*((buf) + 1))))) | | | | ------------------ | | ------------------ ------------------ 2363| | 2364| 19| png_set_tIME(png_ptr, info_ptr, &mod_time); ------------------ | | 438| 19|#define png_set_tIME OSS_FUZZ_png_set_tIME ------------------ 2365| 19| return handled_ok; 2366| 0| PNG_UNUSED(length) ------------------ | | 479| 0|# define PNG_UNUSED(param) (void)param; ------------------ 2367| 0|} pngrutil.c:png_handle_tRNS: 1688| 3.85k|{ 1689| 3.85k| png_byte readbuf[PNG_MAX_PALETTE_LENGTH]; 1690| | 1691| 3.85k| png_debug(1, "in png_handle_tRNS"); ------------------ | | 145| 3.85k|# define png_debug(l, m) ((void)0) ------------------ 1692| | 1693| 3.85k| if (png_ptr->color_type == PNG_COLOR_TYPE_GRAY) ------------------ | | 666| 3.85k|#define PNG_COLOR_TYPE_GRAY 0 ------------------ | Branch (1693:8): [True: 1.04k, False: 2.81k] ------------------ 1694| 1.04k| { 1695| 1.04k| png_byte buf[2]; 1696| | 1697| 1.04k| if (length != 2) ------------------ | Branch (1697:11): [True: 536, False: 504] ------------------ 1698| 536| { 1699| 536| png_crc_finish(png_ptr, length); ------------------ | | 25| 536|#define png_crc_finish OSS_FUZZ_png_crc_finish ------------------ 1700| 536| png_chunk_benign_error(png_ptr, "invalid"); ------------------ | | 238| 536|#define png_chunk_benign_error OSS_FUZZ_png_chunk_benign_error ------------------ 1701| 536| return handled_error; 1702| 536| } 1703| | 1704| 504| png_crc_read(png_ptr, buf, 2); ------------------ | | 24| 504|#define png_crc_read OSS_FUZZ_png_crc_read ------------------ 1705| 504| png_ptr->num_trans = 1; 1706| 504| png_ptr->trans_color.gray = png_get_uint_16(buf); ------------------ | | 320| 504|#define png_get_uint_16 OSS_FUZZ_png_get_uint_16 | | ------------------ | | | | 463| 504|#define OSS_FUZZ_png_get_uint_16(buf) PNG_get_uint_16(buf) | | | | ------------------ | | | | | | 2832| 504| ((png_uint_16) \ | | | | | | 2833| 504| (((unsigned int)(*(buf)) << 8) + \ | | | | | | 2834| 504| ((unsigned int)(*((buf) + 1))))) | | | | ------------------ | | ------------------ ------------------ 1707| 504| } 1708| | 1709| 2.81k| else if (png_ptr->color_type == PNG_COLOR_TYPE_RGB) ------------------ | | 668| 2.81k|#define PNG_COLOR_TYPE_RGB (PNG_COLOR_MASK_COLOR) | | ------------------ | | | | 662| 2.81k|#define PNG_COLOR_MASK_COLOR 2 | | ------------------ ------------------ | Branch (1709:13): [True: 1.38k, False: 1.43k] ------------------ 1710| 1.38k| { 1711| 1.38k| png_byte buf[6]; 1712| | 1713| 1.38k| if (length != 6) ------------------ | Branch (1713:11): [True: 509, False: 872] ------------------ 1714| 509| { 1715| 509| png_crc_finish(png_ptr, length); ------------------ | | 25| 509|#define png_crc_finish OSS_FUZZ_png_crc_finish ------------------ 1716| 509| png_chunk_benign_error(png_ptr, "invalid"); ------------------ | | 238| 509|#define png_chunk_benign_error OSS_FUZZ_png_chunk_benign_error ------------------ 1717| 509| return handled_error; 1718| 509| } 1719| | 1720| 872| png_crc_read(png_ptr, buf, length); ------------------ | | 24| 872|#define png_crc_read OSS_FUZZ_png_crc_read ------------------ 1721| 872| png_ptr->num_trans = 1; 1722| 872| png_ptr->trans_color.red = png_get_uint_16(buf); ------------------ | | 320| 872|#define png_get_uint_16 OSS_FUZZ_png_get_uint_16 | | ------------------ | | | | 463| 872|#define OSS_FUZZ_png_get_uint_16(buf) PNG_get_uint_16(buf) | | | | ------------------ | | | | | | 2832| 872| ((png_uint_16) \ | | | | | | 2833| 872| (((unsigned int)(*(buf)) << 8) + \ | | | | | | 2834| 872| ((unsigned int)(*((buf) + 1))))) | | | | ------------------ | | ------------------ ------------------ 1723| 872| png_ptr->trans_color.green = png_get_uint_16(buf + 2); ------------------ | | 320| 872|#define png_get_uint_16 OSS_FUZZ_png_get_uint_16 | | ------------------ | | | | 463| 872|#define OSS_FUZZ_png_get_uint_16(buf) PNG_get_uint_16(buf) | | | | ------------------ | | | | | | 2832| 872| ((png_uint_16) \ | | | | | | 2833| 872| (((unsigned int)(*(buf)) << 8) + \ | | | | | | 2834| 872| ((unsigned int)(*((buf) + 1))))) | | | | ------------------ | | ------------------ ------------------ 1724| 872| png_ptr->trans_color.blue = png_get_uint_16(buf + 4); ------------------ | | 320| 872|#define png_get_uint_16 OSS_FUZZ_png_get_uint_16 | | ------------------ | | | | 463| 872|#define OSS_FUZZ_png_get_uint_16(buf) PNG_get_uint_16(buf) | | | | ------------------ | | | | | | 2832| 872| ((png_uint_16) \ | | | | | | 2833| 872| (((unsigned int)(*(buf)) << 8) + \ | | | | | | 2834| 872| ((unsigned int)(*((buf) + 1))))) | | | | ------------------ | | ------------------ ------------------ 1725| 872| } 1726| | 1727| 1.43k| else if (png_ptr->color_type == PNG_COLOR_TYPE_PALETTE) ------------------ | | 667| 1.43k|#define PNG_COLOR_TYPE_PALETTE (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_PALETTE) | | ------------------ | | | | 662| 1.43k|#define PNG_COLOR_MASK_COLOR 2 | | ------------------ | | #define PNG_COLOR_TYPE_PALETTE (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_PALETTE) | | ------------------ | | | | 661| 1.43k|#define PNG_COLOR_MASK_PALETTE 1 | | ------------------ ------------------ | Branch (1727:13): [True: 970, False: 464] ------------------ 1728| 970| { 1729| 970| if ((png_ptr->mode & PNG_HAVE_PLTE) == 0) ------------------ | | 643| 970|#define PNG_HAVE_PLTE 0x02 ------------------ | Branch (1729:11): [True: 280, False: 690] ------------------ 1730| 280| { 1731| 280| png_crc_finish(png_ptr, length); ------------------ | | 25| 280|#define png_crc_finish OSS_FUZZ_png_crc_finish ------------------ 1732| 280| png_chunk_benign_error(png_ptr, "out of place"); ------------------ | | 238| 280|#define png_chunk_benign_error OSS_FUZZ_png_chunk_benign_error ------------------ 1733| 280| return handled_error; 1734| 280| } 1735| | 1736| 690| if (length > (unsigned int) png_ptr->num_palette || ------------------ | Branch (1736:11): [True: 203, False: 487] ------------------ 1737| 487| length > (unsigned int) PNG_MAX_PALETTE_LENGTH || ------------------ | | 723| 1.17k|#define PNG_MAX_PALETTE_LENGTH 256 ------------------ | Branch (1737:10): [True: 0, False: 487] ------------------ 1738| 487| length == 0) ------------------ | Branch (1738:10): [True: 194, False: 293] ------------------ 1739| 397| { 1740| 397| png_crc_finish(png_ptr, length); ------------------ | | 25| 397|#define png_crc_finish OSS_FUZZ_png_crc_finish ------------------ 1741| 397| png_chunk_benign_error(png_ptr, "invalid"); ------------------ | | 238| 397|#define png_chunk_benign_error OSS_FUZZ_png_chunk_benign_error ------------------ 1742| 397| return handled_error; 1743| 397| } 1744| | 1745| 293| png_crc_read(png_ptr, readbuf, length); ------------------ | | 24| 293|#define png_crc_read OSS_FUZZ_png_crc_read ------------------ 1746| 293| png_ptr->num_trans = (png_uint_16)length; 1747| 293| } 1748| | 1749| 464| else 1750| 464| { 1751| 464| png_crc_finish(png_ptr, length); ------------------ | | 25| 464|#define png_crc_finish OSS_FUZZ_png_crc_finish ------------------ 1752| 464| png_chunk_benign_error(png_ptr, "invalid with alpha channel"); ------------------ | | 238| 464|#define png_chunk_benign_error OSS_FUZZ_png_chunk_benign_error ------------------ 1753| 464| return handled_error; 1754| 464| } 1755| | 1756| 1.66k| if (png_crc_finish(png_ptr, 0) != 0) ------------------ | | 25| 1.66k|#define png_crc_finish OSS_FUZZ_png_crc_finish ------------------ | Branch (1756:8): [True: 1.03k, False: 633] ------------------ 1757| 1.03k| { 1758| 1.03k| png_ptr->num_trans = 0; 1759| 1.03k| return handled_error; 1760| 1.03k| } 1761| | 1762| 633| png_set_tRNS(png_ptr, info_ptr, readbuf, png_ptr->num_trans, ------------------ | | 439| 633|#define png_set_tRNS OSS_FUZZ_png_set_tRNS ------------------ 1763| 633| &(png_ptr->trans_color)); 1764| 633| return handled_ok; 1765| 1.66k|} pngrutil.c:png_handle_zTXt: 2448| 2.53k|{ 2449| 2.53k| png_const_charp errmsg = NULL; 2450| 2.53k| png_bytep buffer; 2451| 2.53k| png_uint_32 keyword_length; 2452| | 2453| 2.53k| png_debug(1, "in png_handle_zTXt"); ------------------ | | 145| 2.53k|# define png_debug(l, m) ((void)0) ------------------ 2454| | 2455| 2.53k|#ifdef PNG_USER_LIMITS_SUPPORTED 2456| 2.53k| if (png_ptr->user_chunk_cache_max != 0) ------------------ | Branch (2456:8): [True: 2.53k, False: 0] ------------------ 2457| 2.53k| { 2458| 2.53k| if (png_ptr->user_chunk_cache_max == 1) ------------------ | Branch (2458:11): [True: 194, False: 2.34k] ------------------ 2459| 194| { 2460| 194| png_crc_finish(png_ptr, length); ------------------ | | 25| 194|#define png_crc_finish OSS_FUZZ_png_crc_finish ------------------ 2461| 194| return handled_error; 2462| 194| } 2463| | 2464| 2.34k| if (--png_ptr->user_chunk_cache_max == 1) ------------------ | Branch (2464:11): [True: 4, False: 2.34k] ------------------ 2465| 4| { 2466| 4| png_crc_finish(png_ptr, length); ------------------ | | 25| 4|#define png_crc_finish OSS_FUZZ_png_crc_finish ------------------ 2467| 4| png_chunk_benign_error(png_ptr, "no space in chunk cache"); ------------------ | | 238| 4|#define png_chunk_benign_error OSS_FUZZ_png_chunk_benign_error ------------------ 2468| 4| return handled_error; 2469| 4| } 2470| 2.34k| } 2471| 2.34k|#endif 2472| | 2473| | /* Note, "length" is sufficient here; we won't be adding 2474| | * a null terminator later. The limit check in png_handle_chunk should be 2475| | * sufficient. 2476| | */ 2477| 2.34k| buffer = png_read_buffer(png_ptr, length); 2478| | 2479| 2.34k| if (buffer == NULL) ------------------ | Branch (2479:8): [True: 0, False: 2.34k] ------------------ 2480| 0| { 2481| 0| png_crc_finish(png_ptr, length); ------------------ | | 25| 0|#define png_crc_finish OSS_FUZZ_png_crc_finish ------------------ 2482| 0| png_chunk_benign_error(png_ptr, "out of memory"); ------------------ | | 238| 0|#define png_chunk_benign_error OSS_FUZZ_png_chunk_benign_error ------------------ 2483| 0| return handled_error; 2484| 0| } 2485| | 2486| 2.34k| png_crc_read(png_ptr, buffer, length); ------------------ | | 24| 2.34k|#define png_crc_read OSS_FUZZ_png_crc_read ------------------ 2487| | 2488| 2.34k| if (png_crc_finish(png_ptr, 0) != 0) ------------------ | | 25| 2.34k|#define png_crc_finish OSS_FUZZ_png_crc_finish ------------------ | Branch (2488:8): [True: 749, False: 1.59k] ------------------ 2489| 749| return handled_error; 2490| | 2491| | /* TODO: also check that the keyword contents match the spec! */ 2492| 1.59k| for (keyword_length = 0; 2493| 22.7k| keyword_length < length && buffer[keyword_length] != 0; ------------------ | Branch (2493:7): [True: 22.5k, False: 141] | Branch (2493:34): [True: 21.1k, False: 1.45k] ------------------ 2494| 21.1k| ++keyword_length) 2495| 21.1k| /* Empty loop to find end of name */ ; 2496| | 2497| 1.59k| if (keyword_length > 79 || keyword_length < 1) ------------------ | Branch (2497:8): [True: 75, False: 1.51k] | Branch (2497:31): [True: 194, False: 1.32k] ------------------ 2498| 195| errmsg = "bad keyword"; 2499| | 2500| | /* zTXt must have some LZ data after the keyword, although it may expand to 2501| | * zero bytes; we need a '\0' at the end of the keyword, the compression type 2502| | * then the LZ data: 2503| | */ 2504| 1.39k| else if (keyword_length + 3 > length) ------------------ | Branch (2504:13): [True: 66, False: 1.33k] ------------------ 2505| 66| errmsg = "truncated"; 2506| | 2507| 1.33k| else if (buffer[keyword_length+1] != PNG_COMPRESSION_TYPE_BASE) ------------------ | | 676| 1.33k|#define PNG_COMPRESSION_TYPE_BASE 0 /* Deflate method 8, 32K window */ ------------------ | Branch (2507:13): [True: 195, False: 1.13k] ------------------ 2508| 195| errmsg = "unknown compression type"; 2509| | 2510| 1.13k| else 2511| 1.13k| { 2512| 1.13k| png_alloc_size_t uncompressed_length = PNG_SIZE_MAX; ------------------ | | 649| 1.13k|#define PNG_SIZE_MAX ((size_t)(-1)) ------------------ 2513| | 2514| | /* TODO: at present png_decompress_chunk imposes a single application 2515| | * level memory limit, this should be split to different values for iCCP 2516| | * and text chunks. 2517| | */ 2518| 1.13k| if (png_decompress_chunk(png_ptr, length, keyword_length+2, ------------------ | Branch (2518:11): [True: 204, False: 932] ------------------ 2519| 1.13k| &uncompressed_length, 1/*terminate*/) == Z_STREAM_END) 2520| 204| { 2521| 204| png_text text; 2522| | 2523| 204| if (png_ptr->read_buffer == NULL) ------------------ | Branch (2523:14): [True: 0, False: 204] ------------------ 2524| 0| errmsg="Read failure in png_handle_zTXt"; 2525| 204| else 2526| 204| { 2527| | /* It worked; png_ptr->read_buffer now looks like a tEXt chunk 2528| | * except for the extra compression type byte and the fact that 2529| | * it isn't necessarily '\0' terminated. 2530| | */ 2531| 204| buffer = png_ptr->read_buffer; 2532| 204| buffer[uncompressed_length+(keyword_length+2)] = 0; 2533| | 2534| 204| text.compression = PNG_TEXT_COMPRESSION_zTXt; ------------------ | | 587| 204|#define PNG_TEXT_COMPRESSION_zTXt 0 ------------------ 2535| 204| text.key = (png_charp)buffer; 2536| 204| text.text = (png_charp)(buffer + keyword_length+2); 2537| 204| text.text_length = uncompressed_length; 2538| 204| text.itxt_length = 0; 2539| 204| text.lang = NULL; 2540| 204| text.lang_key = NULL; 2541| | 2542| 204| if (png_set_text_2(png_ptr, info_ptr, &text, 1) == 0) ------------------ | | 31| 204|#define png_set_text_2 OSS_FUZZ_png_set_text_2 ------------------ | Branch (2542:17): [True: 204, False: 0] ------------------ 2543| 204| return handled_ok; 2544| | 2545| 0| errmsg = "out of memory"; 2546| 0| } 2547| 204| } 2548| | 2549| 932| else 2550| 932| errmsg = png_ptr->zstream.msg; 2551| 1.13k| } 2552| | 2553| 1.38k| png_chunk_benign_error(png_ptr, errmsg); ------------------ | | 238| 1.38k|#define png_chunk_benign_error OSS_FUZZ_png_chunk_benign_error ------------------ 2554| 1.38k| return handled_error; 2555| 1.59k|} pngrutil.c:png_init_filter_functions: 4127| 816|{ 4128| 816| unsigned int bpp = (pp->pixel_depth + 7) >> 3; 4129| | 4130| 816| pp->read_filter[PNG_FILTER_VALUE_SUB-1] = png_read_filter_row_sub; ------------------ | | 1542| 816|#define PNG_FILTER_VALUE_SUB 1 ------------------ 4131| 816| pp->read_filter[PNG_FILTER_VALUE_UP-1] = png_read_filter_row_up; ------------------ | | 1543| 816|#define PNG_FILTER_VALUE_UP 2 ------------------ 4132| 816| pp->read_filter[PNG_FILTER_VALUE_AVG-1] = png_read_filter_row_avg; ------------------ | | 1544| 816|#define PNG_FILTER_VALUE_AVG 3 ------------------ 4133| 816| if (bpp == 1) ------------------ | Branch (4133:8): [True: 303, False: 513] ------------------ 4134| 303| pp->read_filter[PNG_FILTER_VALUE_PAETH-1] = ------------------ | | 1545| 303|#define PNG_FILTER_VALUE_PAETH 4 ------------------ 4135| 303| png_read_filter_row_paeth_1byte_pixel; 4136| 513| else 4137| 513| pp->read_filter[PNG_FILTER_VALUE_PAETH-1] = ------------------ | | 1545| 513|#define PNG_FILTER_VALUE_PAETH 4 ------------------ 4138| 513| png_read_filter_row_paeth_multibyte_pixel; 4139| | 4140| |#ifdef PNG_FILTER_OPTIMIZATIONS 4141| | /* To use this define PNG_FILTER_OPTIMIZATIONS as the name of a function to 4142| | * call to install hardware optimizations for the above functions; simply 4143| | * replace whatever elements of the pp->read_filter[] array with a hardware 4144| | * specific (or, for that matter, generic) optimization. 4145| | * 4146| | * To see an example of this examine what configure.ac does when 4147| | * --enable-arm-neon is specified on the command line. 4148| | */ 4149| | PNG_FILTER_OPTIMIZATIONS(pp, bpp); 4150| |#endif 4151| 816|} pngrutil.c:png_read_filter_row_sub: 3956| 1.95k|{ 3957| 1.95k| size_t i; 3958| 1.95k| size_t istop = row_info->rowbytes; 3959| 1.95k| unsigned int bpp = (row_info->pixel_depth + 7) >> 3; 3960| 1.95k| png_bytep rp = row + bpp; 3961| | 3962| 1.95k| PNG_UNUSED(prev_row) ------------------ | | 479| 1.95k|# define PNG_UNUSED(param) (void)param; ------------------ 3963| | 3964| 331k| for (i = bpp; i < istop; i++) ------------------ | Branch (3964:18): [True: 329k, False: 1.95k] ------------------ 3965| 329k| { 3966| 329k| *rp = (png_byte)(((int)(*rp) + (int)(*(rp-bpp))) & 0xff); 3967| 329k| rp++; 3968| 329k| } 3969| 1.95k|} pngrutil.c:png_read_filter_row_up: 3974| 1.48k|{ 3975| 1.48k| size_t i; 3976| 1.48k| size_t istop = row_info->rowbytes; 3977| 1.48k| png_bytep rp = row; 3978| 1.48k| png_const_bytep pp = prev_row; 3979| | 3980| 70.9k| for (i = 0; i < istop; i++) ------------------ | Branch (3980:16): [True: 69.4k, False: 1.48k] ------------------ 3981| 69.4k| { 3982| 69.4k| *rp = (png_byte)(((int)(*rp) + (int)(*pp++)) & 0xff); 3983| 69.4k| rp++; 3984| 69.4k| } 3985| 1.48k|} pngrutil.c:png_read_filter_row_avg: 3990| 995|{ 3991| 995| size_t i; 3992| 995| png_bytep rp = row; 3993| 995| png_const_bytep pp = prev_row; 3994| 995| unsigned int bpp = (row_info->pixel_depth + 7) >> 3; 3995| 995| size_t istop = row_info->rowbytes - bpp; 3996| | 3997| 3.23k| for (i = 0; i < bpp; i++) ------------------ | Branch (3997:16): [True: 2.23k, False: 995] ------------------ 3998| 2.23k| { 3999| 2.23k| *rp = (png_byte)(((int)(*rp) + 4000| 2.23k| ((int)(*pp++) / 2 )) & 0xff); 4001| | 4002| 2.23k| rp++; 4003| 2.23k| } 4004| | 4005| 76.7k| for (i = 0; i < istop; i++) ------------------ | Branch (4005:16): [True: 75.7k, False: 995] ------------------ 4006| 75.7k| { 4007| 75.7k| *rp = (png_byte)(((int)(*rp) + 4008| 75.7k| (int)(*pp++ + *(rp-bpp)) / 2 ) & 0xff); 4009| | 4010| 75.7k| rp++; 4011| 75.7k| } 4012| 995|} pngrutil.c:png_read_filter_row_paeth_1byte_pixel: 4017| 1.28k|{ 4018| 1.28k| png_bytep rp_end = row + row_info->rowbytes; 4019| 1.28k| int a, c; 4020| | 4021| | /* First pixel/byte */ 4022| 1.28k| c = *prev_row++; 4023| 1.28k| a = *row + c; 4024| 1.28k| *row++ = (png_byte)a; 4025| | 4026| | /* Remainder */ 4027| 8.62k| while (row < rp_end) ------------------ | Branch (4027:11): [True: 7.33k, False: 1.28k] ------------------ 4028| 7.33k| { 4029| 7.33k| int b, pa, pb, pc, p; 4030| | 4031| 7.33k| a &= 0xff; /* From previous iteration or start */ 4032| 7.33k| b = *prev_row++; 4033| | 4034| 7.33k| p = b - c; 4035| 7.33k| pc = a - c; 4036| | 4037| |#ifdef PNG_USE_ABS 4038| | pa = abs(p); 4039| | pb = abs(pc); 4040| | pc = abs(p + pc); 4041| |#else 4042| 7.33k| pa = p < 0 ? -p : p; ------------------ | Branch (4042:12): [True: 1.11k, False: 6.22k] ------------------ 4043| 7.33k| pb = pc < 0 ? -pc : pc; ------------------ | Branch (4043:12): [True: 903, False: 6.42k] ------------------ 4044| 7.33k| pc = (p + pc) < 0 ? -(p + pc) : p + pc; ------------------ | Branch (4044:12): [True: 1.31k, False: 6.02k] ------------------ 4045| 7.33k|#endif 4046| | 4047| | /* Find the best predictor, the least of pa, pb, pc favoring the earlier 4048| | * ones in the case of a tie. 4049| | */ 4050| 7.33k| if (pb < pa) ------------------ | Branch (4050:11): [True: 1.30k, False: 6.02k] ------------------ 4051| 1.30k| { 4052| 1.30k| pa = pb; a = b; 4053| 1.30k| } 4054| 7.33k| if (pc < pa) a = c; ------------------ | Branch (4054:11): [True: 352, False: 6.98k] ------------------ 4055| | 4056| | /* Calculate the current pixel in a, and move the previous row pixel to c 4057| | * for the next time round the loop 4058| | */ 4059| 7.33k| c = b; 4060| 7.33k| a += *row; 4061| 7.33k| *row++ = (png_byte)a; 4062| 7.33k| } 4063| 1.28k|} pngrutil.c:png_read_filter_row_paeth_multibyte_pixel: 4068| 1.08k|{ 4069| 1.08k| unsigned int bpp = (row_info->pixel_depth + 7) >> 3; 4070| 1.08k| png_bytep rp_end = row + bpp; 4071| | 4072| | /* Process the first pixel in the row completely (this is the same as 'up' 4073| | * because there is only one candidate predictor for the first row). 4074| | */ 4075| 5.62k| while (row < rp_end) ------------------ | Branch (4075:11): [True: 4.53k, False: 1.08k] ------------------ 4076| 4.53k| { 4077| 4.53k| int a = *row + *prev_row++; 4078| 4.53k| *row++ = (png_byte)a; 4079| 4.53k| } 4080| | 4081| | /* Remainder */ 4082| 1.08k| rp_end = rp_end + (row_info->rowbytes - bpp); 4083| | 4084| 366k| while (row < rp_end) ------------------ | Branch (4084:11): [True: 365k, False: 1.08k] ------------------ 4085| 365k| { 4086| 365k| int a, b, c, pa, pb, pc, p; 4087| | 4088| 365k| c = *(prev_row - bpp); 4089| 365k| a = *(row - bpp); 4090| 365k| b = *prev_row++; 4091| | 4092| 365k| p = b - c; 4093| 365k| pc = a - c; 4094| | 4095| |#ifdef PNG_USE_ABS 4096| | pa = abs(p); 4097| | pb = abs(pc); 4098| | pc = abs(p + pc); 4099| |#else 4100| 365k| pa = p < 0 ? -p : p; ------------------ | Branch (4100:12): [True: 33.2k, False: 332k] ------------------ 4101| 365k| pb = pc < 0 ? -pc : pc; ------------------ | Branch (4101:12): [True: 43.7k, False: 321k] ------------------ 4102| 365k| pc = (p + pc) < 0 ? -(p + pc) : p + pc; ------------------ | Branch (4102:12): [True: 59.3k, False: 306k] ------------------ 4103| 365k|#endif 4104| | 4105| 365k| if (pb < pa) ------------------ | Branch (4105:11): [True: 64.7k, False: 300k] ------------------ 4106| 64.7k| { 4107| 64.7k| pa = pb; a = b; 4108| 64.7k| } 4109| 365k| if (pc < pa) a = c; ------------------ | Branch (4109:11): [True: 5.85k, False: 359k] ------------------ 4110| | 4111| 365k| a += *row; 4112| 365k| *row++ = (png_byte)a; 4113| 365k| } 4114| 1.08k|} pngrutil.c:png_read_buffer: 377| 62.0k|{ 378| 62.0k| png_bytep buffer = png_ptr->read_buffer; 379| | 380| 62.0k| if (new_size > png_chunk_max(png_ptr)) return NULL; ------------------ | | 1126| 62.0k|# define png_chunk_max(png_ptr) ((png_ptr)->user_chunk_malloc_max) ------------------ | Branch (380:8): [True: 80, False: 61.9k] ------------------ 381| | 382| 61.9k| if (buffer != NULL && new_size > png_ptr->read_buffer_size) ------------------ | Branch (382:8): [True: 58.9k, False: 2.95k] | Branch (382:26): [True: 347, False: 58.6k] ------------------ 383| 347| { 384| 347| png_ptr->read_buffer = NULL; 385| 347| png_ptr->read_buffer_size = 0; 386| 347| png_free(png_ptr, buffer); ------------------ | | 253| 347|#define png_free OSS_FUZZ_png_free ------------------ 387| 347| buffer = NULL; 388| 347| } 389| | 390| 61.9k| if (buffer == NULL) ------------------ | Branch (390:8): [True: 3.29k, False: 58.6k] ------------------ 391| 3.29k| { 392| 3.29k| buffer = png_voidcast(png_bytep, png_malloc_base(png_ptr, new_size)); ------------------ | | 535| 3.29k|# define png_voidcast(type, value) (value) ------------------ 393| | 394| 3.29k| if (buffer != NULL) ------------------ | Branch (394:11): [True: 3.29k, False: 0] ------------------ 395| 3.29k| { 396| 3.29k|# ifndef PNG_NO_MEMZERO /* for detecting UIM bugs **only** */ 397| 3.29k| memset(buffer, 0, new_size); /* just in case */ 398| 3.29k|# endif 399| 3.29k| png_ptr->read_buffer = buffer; 400| 3.29k| png_ptr->read_buffer_size = new_size; 401| 3.29k| } 402| 3.29k| } 403| | 404| 61.9k| return buffer; 405| 62.0k|} pngrutil.c:png_inflate_claim: 415| 10.4k|{ 416| 10.4k| if (png_ptr->zowner != 0) ------------------ | Branch (416:8): [True: 0, False: 10.4k] ------------------ 417| 0| { 418| 0| char msg[64]; 419| | 420| 0| PNG_STRING_FROM_CHUNK(msg, png_ptr->zowner); ------------------ | | 931| 0| (void)(((char*)(s))[0]=(char)(((c)>>24) & 0xff), \ | | 932| 0| ((char*)(s))[1]=(char)(((c)>>16) & 0xff),\ | | 933| 0| ((char*)(s))[2]=(char)(((c)>>8) & 0xff), \ | | 934| 0| ((char*)(s))[3]=(char)((c & 0xff))) ------------------ 421| | /* So the message that results is " using zstream"; this is an 422| | * internal error, but is very useful for debugging. i18n requirements 423| | * are minimal. 424| | */ 425| 0| (void)png_safecat(msg, (sizeof msg), 4, " using zstream"); ------------------ | | 75| 0|#define png_safecat OSS_FUZZ_png_safecat ------------------ 426| |#if PNG_RELEASE_BUILD 427| | png_chunk_warning(png_ptr, msg); 428| | png_ptr->zowner = 0; 429| |#else 430| 0| png_chunk_error(png_ptr, msg); ------------------ | | 239| 0|#define png_chunk_error OSS_FUZZ_png_chunk_error ------------------ 431| 0|#endif 432| 0| } 433| | 434| | /* Implementation note: unlike 'png_deflate_claim' this internal function 435| | * does not take the size of the data as an argument. Some efficiency could 436| | * be gained by using this when it is known *if* the zlib stream itself does 437| | * not record the number; however, this is an illusion: the original writer 438| | * of the PNG may have selected a lower window size, and we really must 439| | * follow that because, for systems with limited capabilities, we 440| | * would otherwise reject the application's attempts to use a smaller window 441| | * size (zlib doesn't have an interface to say "this or lower"!). 442| | * 443| | * inflateReset2 was added to zlib 1.2.4; before this the window could not be 444| | * reset, therefore it is necessary to always allocate the maximum window 445| | * size with earlier zlibs just in case later compressed chunks need it. 446| | */ 447| 10.4k| { 448| 10.4k| int ret; /* zlib return code */ 449| 10.4k|#if ZLIB_VERNUM >= 0x1240 450| 10.4k| int window_bits = 0; 451| | 452| 10.4k|# if defined(PNG_SET_OPTION_SUPPORTED) && defined(PNG_MAXIMUM_INFLATE_WINDOW) 453| 10.4k| if (((png_ptr->options >> PNG_MAXIMUM_INFLATE_WINDOW) & 3) == ------------------ | | 3462| 10.4k|#define PNG_MAXIMUM_INFLATE_WINDOW 2 ------------------ | Branch (453:11): [True: 0, False: 10.4k] ------------------ 454| 10.4k| PNG_OPTION_ON) ------------------ | | 3499| 10.4k|#define PNG_OPTION_ON 3 ------------------ 455| 0| { 456| 0| window_bits = 15; 457| 0| png_ptr->zstream_start = 0; /* fixed window size */ 458| 0| } 459| | 460| 10.4k| else 461| 10.4k| { 462| 10.4k| png_ptr->zstream_start = 1; 463| 10.4k| } 464| 10.4k|# endif 465| | 466| 10.4k|#endif /* ZLIB_VERNUM >= 0x1240 */ 467| | 468| | /* Set this for safety, just in case the previous owner left pointers to 469| | * memory allocations. 470| | */ 471| 10.4k| png_ptr->zstream.next_in = NULL; 472| 10.4k| png_ptr->zstream.avail_in = 0; 473| 10.4k| png_ptr->zstream.next_out = NULL; 474| 10.4k| png_ptr->zstream.avail_out = 0; 475| | 476| 10.4k| if ((png_ptr->flags & PNG_FLAG_ZSTREAM_INITIALIZED) != 0) ------------------ | | 696| 10.4k|#define PNG_FLAG_ZSTREAM_INITIALIZED 0x0002U /* Added to libpng-1.6.0 */ ------------------ | Branch (476:11): [True: 7.50k, False: 2.92k] ------------------ 477| 7.50k| { 478| 7.50k|#if ZLIB_VERNUM >= 0x1240 479| 7.50k| ret = inflateReset2(&png_ptr->zstream, window_bits); 480| |#else 481| | ret = inflateReset(&png_ptr->zstream); 482| |#endif 483| 7.50k| } 484| | 485| 2.92k| else 486| 2.92k| { 487| 2.92k|#if ZLIB_VERNUM >= 0x1240 488| 2.92k| ret = inflateInit2(&png_ptr->zstream, window_bits); 489| |#else 490| | ret = inflateInit(&png_ptr->zstream); 491| |#endif 492| | 493| 2.92k| if (ret == Z_OK) ------------------ | Branch (493:14): [True: 2.92k, False: 0] ------------------ 494| 2.92k| png_ptr->flags |= PNG_FLAG_ZSTREAM_INITIALIZED; ------------------ | | 696| 2.92k|#define PNG_FLAG_ZSTREAM_INITIALIZED 0x0002U /* Added to libpng-1.6.0 */ ------------------ 495| 2.92k| } 496| | 497| |#ifdef PNG_DISABLE_ADLER32_CHECK_SUPPORTED 498| | if (((png_ptr->options >> PNG_IGNORE_ADLER32) & 3) == PNG_OPTION_ON) 499| | /* Turn off validation of the ADLER32 checksum in IDAT chunks */ 500| | ret = inflateValidate(&png_ptr->zstream, 0); 501| |#endif 502| | 503| 10.4k| if (ret == Z_OK) ------------------ | Branch (503:11): [True: 10.4k, False: 0] ------------------ 504| 10.4k| png_ptr->zowner = owner; 505| | 506| 0| else 507| 0| png_zstream_error(png_ptr, ret); ------------------ | | 4| 0|#define png_zstream_error OSS_FUZZ_png_zstream_error ------------------ 508| | 509| 10.4k| return ret; 510| 10.4k| } 511| | 512| |#ifdef window_bits 513| |# undef window_bits 514| |#endif 515| 10.4k|} OSS_FUZZ_png_set_bKGD: 26| 19|{ 27| 19| png_debug1(1, "in %s storage function", "bKGD"); ------------------ | | 148| 19|# define png_debug1(l, m, p1) ((void)0) ------------------ 28| | 29| 19| if (png_ptr == NULL || info_ptr == NULL || background == NULL) ------------------ | Branch (29:8): [True: 0, False: 19] | Branch (29:27): [True: 0, False: 19] | Branch (29:47): [True: 0, False: 19] ------------------ 30| 0| return; 31| | 32| 19| info_ptr->background = *background; 33| 19| info_ptr->valid |= PNG_INFO_bKGD; ------------------ | | 735| 19|#define PNG_INFO_bKGD 0x0020U ------------------ 34| 19|} OSS_FUZZ_png_set_cHRM_fixed: 43| 90|{ 44| 90| png_debug1(1, "in %s storage function", "cHRM fixed"); ------------------ | | 148| 90|# define png_debug1(l, m, p1) ((void)0) ------------------ 45| | 46| 90| if (png_ptr == NULL || info_ptr == NULL) ------------------ | Branch (46:8): [True: 0, False: 90] | Branch (46:27): [True: 0, False: 90] ------------------ 47| 0| return; 48| | 49| 90| info_ptr->cHRM.redx = red_x; 50| 90| info_ptr->cHRM.redy = red_y; 51| 90| info_ptr->cHRM.greenx = green_x; 52| 90| info_ptr->cHRM.greeny = green_y; 53| 90| info_ptr->cHRM.bluex = blue_x; 54| 90| info_ptr->cHRM.bluey = blue_y; 55| 90| info_ptr->cHRM.whitex = white_x; 56| 90| info_ptr->cHRM.whitey = white_y; 57| | 58| 90| info_ptr->valid |= PNG_INFO_cHRM; ------------------ | | 732| 90|#define PNG_INFO_cHRM 0x0004U ------------------ 59| 90|} OSS_FUZZ_png_set_cICP: 139| 6|{ 140| 6| png_debug1(1, "in %s storage function", "cICP"); ------------------ | | 148| 6|# define png_debug1(l, m, p1) ((void)0) ------------------ 141| | 142| 6| if (png_ptr == NULL || info_ptr == NULL) ------------------ | Branch (142:8): [True: 0, False: 6] | Branch (142:27): [True: 0, False: 6] ------------------ 143| 0| return; 144| | 145| 6| info_ptr->cicp_colour_primaries = colour_primaries; 146| 6| info_ptr->cicp_transfer_function = transfer_function; 147| 6| info_ptr->cicp_matrix_coefficients = matrix_coefficients; 148| 6| info_ptr->cicp_video_full_range_flag = video_full_range_flag; 149| | 150| 6| if (info_ptr->cicp_matrix_coefficients != 0) ------------------ | Branch (150:8): [True: 1, False: 5] ------------------ 151| 1| { 152| 1| png_warning(png_ptr, "Invalid cICP matrix coefficients"); ------------------ | | 450| 1|#define png_warning OSS_FUZZ_png_warning ------------------ 153| 1| return; 154| 1| } 155| | 156| 5| info_ptr->valid |= PNG_INFO_cICP; ------------------ | | 747| 5|#define PNG_INFO_cICP 0x20000U /* PNGv3: 1.6.45 */ ------------------ 157| 5|} OSS_FUZZ_png_set_cLLI_fixed: 167| 34|{ 168| 34| png_debug1(1, "in %s storage function", "cLLI"); ------------------ | | 148| 34|# define png_debug1(l, m, p1) ((void)0) ------------------ 169| | 170| 34| if (png_ptr == NULL || info_ptr == NULL) ------------------ | Branch (170:8): [True: 0, False: 34] | Branch (170:27): [True: 0, False: 34] ------------------ 171| 0| return; 172| | 173| | /* Check the light level range: */ 174| 34| if (maxCLL > 0x7FFFFFFFU || maxFALL > 0x7FFFFFFFU) ------------------ | Branch (174:8): [True: 4, False: 30] | Branch (174:32): [True: 6, False: 24] ------------------ 175| 10| { 176| | /* The limit is 200kcd/m2; somewhat bright but not inconceivable because 177| | * human vision is said to run up to 100Mcd/m2. The sun is about 2Gcd/m2. 178| | * 179| | * The reference sRGB monitor is 80cd/m2 and the limit of PQ encoding is 180| | * 2kcd/m2. 181| | */ 182| 10| png_chunk_report(png_ptr, "cLLI light level exceeds PNG limit", ------------------ | | 83| 10|#define png_chunk_report OSS_FUZZ_png_chunk_report ------------------ 183| 10| PNG_CHUNK_WRITE_ERROR); ------------------ | | 2054| 10|#define PNG_CHUNK_WRITE_ERROR 1 /* an error only on write */ ------------------ 184| 10| return; 185| 10| } 186| | 187| 24| info_ptr->maxCLL = maxCLL; 188| 24| info_ptr->maxFALL = maxFALL; 189| 24| info_ptr->valid |= PNG_INFO_cLLI; ------------------ | | 748| 24|#define PNG_INFO_cLLI 0x40000U /* PNGv3: 1.6.45 */ ------------------ 190| 24|} OSS_FUZZ_png_set_mDCV_fixed: 232| 62|{ 233| 62| png_uint_16 rx, ry, gx, gy, bx, by, wx, wy; 234| 62| int error; 235| | 236| 62| png_debug1(1, "in %s storage function", "mDCV"); ------------------ | | 148| 62|# define png_debug1(l, m, p1) ((void)0) ------------------ 237| | 238| 62| if (png_ptr == NULL || info_ptr == NULL) ------------------ | Branch (238:8): [True: 0, False: 62] | Branch (238:27): [True: 0, False: 62] ------------------ 239| 0| return; 240| | 241| | /* Check the input values to ensure they are in the expected range: */ 242| 62| error = 0; 243| 62| rx = png_ITU_fixed_16(&error, red_x); 244| 62| ry = png_ITU_fixed_16(&error, red_y); 245| 62| gx = png_ITU_fixed_16(&error, green_x); 246| 62| gy = png_ITU_fixed_16(&error, green_y); 247| 62| bx = png_ITU_fixed_16(&error, blue_x); 248| 62| by = png_ITU_fixed_16(&error, blue_y); 249| 62| wx = png_ITU_fixed_16(&error, white_x); 250| 62| wy = png_ITU_fixed_16(&error, white_y); 251| | 252| 62| if (error) ------------------ | Branch (252:8): [True: 0, False: 62] ------------------ 253| 0| { 254| 0| png_chunk_report(png_ptr, ------------------ | | 83| 0|#define png_chunk_report OSS_FUZZ_png_chunk_report ------------------ 255| 0| "mDCV chromaticities outside representable range", 256| 0| PNG_CHUNK_WRITE_ERROR); ------------------ | | 2054| 0|#define PNG_CHUNK_WRITE_ERROR 1 /* an error only on write */ ------------------ 257| 0| return; 258| 0| } 259| | 260| | /* Check the light level range: */ 261| 62| if (maxDL > 0x7FFFFFFFU || minDL > 0x7FFFFFFFU) ------------------ | Branch (261:8): [True: 14, False: 48] | Branch (261:31): [True: 10, False: 38] ------------------ 262| 24| { 263| | /* The limit is 200kcd/m2; somewhat bright but not inconceivable because 264| | * human vision is said to run up to 100Mcd/m2. The sun is about 2Gcd/m2. 265| | * 266| | * The reference sRGB monitor is 80cd/m2 and the limit of PQ encoding is 267| | * 2kcd/m2. 268| | */ 269| 24| png_chunk_report(png_ptr, "mDCV display light level exceeds PNG limit", ------------------ | | 83| 24|#define png_chunk_report OSS_FUZZ_png_chunk_report ------------------ 270| 24| PNG_CHUNK_WRITE_ERROR); ------------------ | | 2054| 24|#define PNG_CHUNK_WRITE_ERROR 1 /* an error only on write */ ------------------ 271| 24| return; 272| 24| } 273| | 274| | /* All values are safe, the settings are accepted. 275| | * 276| | * IMPLEMENTATION NOTE: in practice the values can be checked and assigned 277| | * but the result is confusing if a writing app calls png_set_mDCV more than 278| | * once, the second time with an invalid value. This approach is more 279| | * obviously correct at the cost of typing and a very slight machine 280| | * overhead. 281| | */ 282| 38| info_ptr->mastering_red_x = rx; 283| 38| info_ptr->mastering_red_y = ry; 284| 38| info_ptr->mastering_green_x = gx; 285| 38| info_ptr->mastering_green_y = gy; 286| 38| info_ptr->mastering_blue_x = bx; 287| 38| info_ptr->mastering_blue_y = by; 288| 38| info_ptr->mastering_white_x = wx; 289| 38| info_ptr->mastering_white_y = wy; 290| 38| info_ptr->mastering_maxDL = maxDL; 291| 38| info_ptr->mastering_minDL = minDL; 292| 38| info_ptr->valid |= PNG_INFO_mDCV; ------------------ | | 749| 38|#define PNG_INFO_mDCV 0x80000U /* PNGv3: 1.6.45 */ ------------------ 293| 38|} OSS_FUZZ_png_set_eXIf_1: 330| 6|{ 331| 6| png_bytep new_exif; 332| | 333| 6| png_debug1(1, "in %s storage function", "eXIf"); ------------------ | | 148| 6|# define png_debug1(l, m, p1) ((void)0) ------------------ 334| | 335| 6| if (png_ptr == NULL || info_ptr == NULL || ------------------ | Branch (335:8): [True: 0, False: 6] | Branch (335:27): [True: 0, False: 6] ------------------ 336| 6| (png_ptr->mode & PNG_WROTE_eXIf) != 0 || ------------------ | | 654| 6|#define PNG_WROTE_eXIf 0x4000U ------------------ | Branch (336:8): [True: 0, False: 6] ------------------ 337| 6| exif == NULL) ------------------ | Branch (337:8): [True: 0, False: 6] ------------------ 338| 0| return; 339| | 340| 6| new_exif = png_voidcast(png_bytep, png_malloc_warn(png_ptr, num_exif)); ------------------ | | 535| 6|# define png_voidcast(type, value) (value) ------------------ 341| | 342| 6| if (new_exif == NULL) ------------------ | Branch (342:8): [True: 0, False: 6] ------------------ 343| 0| { 344| 0| png_warning(png_ptr, "Insufficient memory for eXIf chunk data"); ------------------ | | 450| 0|#define png_warning OSS_FUZZ_png_warning ------------------ 345| 0| return; 346| 0| } 347| | 348| 6| memcpy(new_exif, exif, (size_t)num_exif); 349| | 350| 6| png_free_data(png_ptr, info_ptr, PNG_FREE_EXIF, 0); ------------------ | | 254| 6|#define png_free_data OSS_FUZZ_png_free_data ------------------ png_free_data(png_ptr, info_ptr, PNG_FREE_EXIF, 0); ------------------ | | 1851| 6|#define PNG_FREE_EXIF 0x8000U /* Added at libpng-1.6.31 */ ------------------ 351| | 352| 6| info_ptr->num_exif = num_exif; 353| 6| info_ptr->exif = new_exif; 354| 6| info_ptr->free_me |= PNG_FREE_EXIF; ------------------ | | 1851| 6|#define PNG_FREE_EXIF 0x8000U /* Added at libpng-1.6.31 */ ------------------ 355| 6| info_ptr->valid |= PNG_INFO_eXIf; ------------------ | | 746| 6|#define PNG_INFO_eXIf 0x10000U /* GR-P, 1.6.31 */ ------------------ 356| 6|} OSS_FUZZ_png_set_gAMA_fixed: 363| 88|{ 364| 88| png_debug1(1, "in %s storage function", "gAMA"); ------------------ | | 148| 88|# define png_debug1(l, m, p1) ((void)0) ------------------ 365| | 366| 88| if (png_ptr == NULL || info_ptr == NULL) ------------------ | Branch (366:8): [True: 0, False: 88] | Branch (366:27): [True: 0, False: 88] ------------------ 367| 0| return; 368| | 369| 88| info_ptr->gamma = file_gamma; 370| 88| info_ptr->valid |= PNG_INFO_gAMA; ------------------ | | 730| 88|#define PNG_INFO_gAMA 0x0001U ------------------ 371| 88|} OSS_FUZZ_png_set_hIST: 387| 4|{ 388| 4| png_uint_16 safe_hist[PNG_MAX_PALETTE_LENGTH]; 389| 4| int i; 390| | 391| 4| png_debug1(1, "in %s storage function", "hIST"); ------------------ | | 148| 4|# define png_debug1(l, m, p1) ((void)0) ------------------ 392| | 393| 4| if (png_ptr == NULL || info_ptr == NULL || hist == NULL) ------------------ | Branch (393:8): [True: 0, False: 4] | Branch (393:27): [True: 0, False: 4] | Branch (393:47): [True: 0, False: 4] ------------------ 394| 0| return; 395| | 396| 4| if (info_ptr->num_palette == 0 || info_ptr->num_palette ------------------ | Branch (396:8): [True: 4, False: 0] | Branch (396:38): [True: 0, False: 0] ------------------ 397| 0| > PNG_MAX_PALETTE_LENGTH) ------------------ | | 723| 0|#define PNG_MAX_PALETTE_LENGTH 256 ------------------ 398| 4| { 399| 4| png_warning(png_ptr, ------------------ | | 450| 4|#define png_warning OSS_FUZZ_png_warning ------------------ 400| 4| "Invalid palette size, hIST allocation skipped"); 401| | 402| 4| return; 403| 4| } 404| | 405| | /* Snapshot the caller's hist before freeing, in case it points to 406| | * info_ptr->hist (getter-to-setter aliasing). 407| | */ 408| 0| memcpy(safe_hist, hist, (unsigned int)info_ptr->num_palette * 409| 0| (sizeof (png_uint_16))); 410| 0| hist = safe_hist; 411| | 412| 0| png_free_data(png_ptr, info_ptr, PNG_FREE_HIST, 0); ------------------ | | 254| 0|#define png_free_data OSS_FUZZ_png_free_data ------------------ png_free_data(png_ptr, info_ptr, PNG_FREE_HIST, 0); ------------------ | | 1838| 0|#define PNG_FREE_HIST 0x0008U ------------------ 413| | 414| | /* Changed from info->num_palette to PNG_MAX_PALETTE_LENGTH in 415| | * version 1.2.1 416| | */ 417| 0| info_ptr->hist = png_voidcast(png_uint_16p, png_malloc_warn(png_ptr, ------------------ | | 535| 0|# define png_voidcast(type, value) (value) ------------------ 418| 0| PNG_MAX_PALETTE_LENGTH * (sizeof (png_uint_16)))); 419| | 420| 0| if (info_ptr->hist == NULL) ------------------ | Branch (420:8): [True: 0, False: 0] ------------------ 421| 0| { 422| 0| png_warning(png_ptr, "Insufficient memory for hIST chunk data"); ------------------ | | 450| 0|#define png_warning OSS_FUZZ_png_warning ------------------ 423| 0| return; 424| 0| } 425| | 426| 0| for (i = 0; i < info_ptr->num_palette; i++) ------------------ | Branch (426:16): [True: 0, False: 0] ------------------ 427| 0| info_ptr->hist[i] = hist[i]; 428| | 429| 0| info_ptr->free_me |= PNG_FREE_HIST; ------------------ | | 1838| 0|#define PNG_FREE_HIST 0x0008U ------------------ 430| 0| info_ptr->valid |= PNG_INFO_hIST; ------------------ | | 736| 0|#define PNG_INFO_hIST 0x0040U ------------------ 431| 0|} OSS_FUZZ_png_set_IHDR: 439| 5.28k|{ 440| 5.28k| png_debug1(1, "in %s storage function", "IHDR"); ------------------ | | 148| 5.28k|# define png_debug1(l, m, p1) ((void)0) ------------------ 441| | 442| 5.28k| if (png_ptr == NULL || info_ptr == NULL) ------------------ | Branch (442:8): [True: 0, False: 5.28k] | Branch (442:27): [True: 0, False: 5.28k] ------------------ 443| 0| return; 444| | 445| 5.28k| info_ptr->width = width; 446| 5.28k| info_ptr->height = height; 447| 5.28k| info_ptr->bit_depth = (png_byte)bit_depth; 448| 5.28k| info_ptr->color_type = (png_byte)color_type; 449| 5.28k| info_ptr->compression_type = (png_byte)compression_type; 450| 5.28k| info_ptr->filter_type = (png_byte)filter_type; 451| 5.28k| info_ptr->interlace_type = (png_byte)interlace_type; 452| | 453| 5.28k| png_check_IHDR (png_ptr, info_ptr->width, info_ptr->height, ------------------ | | 72| 5.28k|#define png_check_IHDR OSS_FUZZ_png_check_IHDR ------------------ 454| 5.28k| info_ptr->bit_depth, info_ptr->color_type, info_ptr->interlace_type, 455| 5.28k| info_ptr->compression_type, info_ptr->filter_type); 456| | 457| 5.28k| if (info_ptr->color_type == PNG_COLOR_TYPE_PALETTE) ------------------ | | 667| 5.28k|#define PNG_COLOR_TYPE_PALETTE (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_PALETTE) | | ------------------ | | | | 662| 5.28k|#define PNG_COLOR_MASK_COLOR 2 | | ------------------ | | #define PNG_COLOR_TYPE_PALETTE (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_PALETTE) | | ------------------ | | | | 661| 5.28k|#define PNG_COLOR_MASK_PALETTE 1 | | ------------------ ------------------ | Branch (457:8): [True: 1.05k, False: 4.22k] ------------------ 458| 1.05k| info_ptr->channels = 1; 459| | 460| 4.22k| else if ((info_ptr->color_type & PNG_COLOR_MASK_COLOR) != 0) ------------------ | | 662| 4.22k|#define PNG_COLOR_MASK_COLOR 2 ------------------ | Branch (460:13): [True: 2.14k, False: 2.07k] ------------------ 461| 2.14k| info_ptr->channels = 3; 462| | 463| 2.07k| else 464| 2.07k| info_ptr->channels = 1; 465| | 466| 5.28k| if ((info_ptr->color_type & PNG_COLOR_MASK_ALPHA) != 0) ------------------ | | 663| 5.28k|#define PNG_COLOR_MASK_ALPHA 4 ------------------ | Branch (466:8): [True: 1.03k, False: 4.25k] ------------------ 467| 1.03k| info_ptr->channels++; 468| | 469| 5.28k| info_ptr->pixel_depth = (png_byte)(info_ptr->channels * info_ptr->bit_depth); 470| | 471| 5.28k| info_ptr->rowbytes = PNG_ROWBYTES(info_ptr->pixel_depth, width); ------------------ | | 755| 5.28k| ((pixel_bits) >= 8 ? \ | | ------------------ | | | Branch (755:6): [True: 3.42k, False: 1.85k] | | ------------------ | | 756| 5.28k| ((size_t)(width) * (((size_t)(pixel_bits)) >> 3)) : \ | | 757| 5.28k| (( ((size_t)(width) * ((size_t)(pixel_bits))) + 7) >> 3) ) ------------------ 472| 5.28k|} OSS_FUZZ_png_set_oFFs: 478| 12|{ 479| 12| png_debug1(1, "in %s storage function", "oFFs"); ------------------ | | 148| 12|# define png_debug1(l, m, p1) ((void)0) ------------------ 480| | 481| 12| if (png_ptr == NULL || info_ptr == NULL) ------------------ | Branch (481:8): [True: 0, False: 12] | Branch (481:27): [True: 0, False: 12] ------------------ 482| 0| return; 483| | 484| 12| info_ptr->x_offset = offset_x; 485| 12| info_ptr->y_offset = offset_y; 486| 12| info_ptr->offset_unit_type = (png_byte)unit_type; 487| 12| info_ptr->valid |= PNG_INFO_oFFs; ------------------ | | 738| 12|#define PNG_INFO_oFFs 0x0100U ------------------ 488| 12|} OSS_FUZZ_png_set_pCAL: 496| 25|{ 497| 25| size_t length; 498| 25| int i; 499| | 500| 25| png_debug1(1, "in %s storage function", "pCAL"); ------------------ | | 148| 25|# define png_debug1(l, m, p1) ((void)0) ------------------ 501| | 502| 25| if (png_ptr == NULL || info_ptr == NULL || purpose == NULL || units == NULL ------------------ | Branch (502:8): [True: 0, False: 25] | Branch (502:27): [True: 0, False: 25] | Branch (502:47): [True: 0, False: 25] | Branch (502:66): [True: 0, False: 25] ------------------ 503| 25| || (nparams > 0 && params == NULL)) ------------------ | Branch (503:12): [True: 20, False: 5] | Branch (503:27): [True: 0, False: 20] ------------------ 504| 0| return; 505| | 506| 25| length = strlen(purpose) + 1; 507| 25| png_debug1(3, "allocating purpose for info (%lu bytes)", ------------------ | | 148| 25|# define png_debug1(l, m, p1) ((void)0) ------------------ 508| 25| (unsigned long)length); 509| | 510| | /* TODO: validate format of calibration name and unit name */ 511| | 512| | /* Check that the type matches the specification. */ 513| 25| if (type < 0 || type > 3) ------------------ | Branch (513:8): [True: 0, False: 25] | Branch (513:20): [True: 10, False: 15] ------------------ 514| 10| { 515| 10| png_chunk_report(png_ptr, "Invalid pCAL equation type", ------------------ | | 83| 10|#define png_chunk_report OSS_FUZZ_png_chunk_report ------------------ 516| 10| PNG_CHUNK_WRITE_ERROR); ------------------ | | 2054| 10|#define PNG_CHUNK_WRITE_ERROR 1 /* an error only on write */ ------------------ 517| 10| return; 518| 10| } 519| | 520| 15| if (nparams < 0 || nparams > 255) ------------------ | Branch (520:8): [True: 0, False: 15] | Branch (520:23): [True: 0, False: 15] ------------------ 521| 0| { 522| 0| png_chunk_report(png_ptr, "Invalid pCAL parameter count", ------------------ | | 83| 0|#define png_chunk_report OSS_FUZZ_png_chunk_report ------------------ 523| 0| PNG_CHUNK_WRITE_ERROR); ------------------ | | 2054| 0|#define PNG_CHUNK_WRITE_ERROR 1 /* an error only on write */ ------------------ 524| 0| return; 525| 0| } 526| | 527| | /* Validate params[nparams] */ 528| 30| for (i=0; ipcal_purpose = png_voidcast(png_charp, ------------------ | | 535| 4|# define png_voidcast(type, value) (value) ------------------ 540| 4| png_malloc_warn(png_ptr, length)); 541| | 542| 4| if (info_ptr->pcal_purpose == NULL) ------------------ | Branch (542:8): [True: 0, False: 4] ------------------ 543| 0| { 544| 0| png_chunk_report(png_ptr, "Insufficient memory for pCAL purpose", ------------------ | | 83| 0|#define png_chunk_report OSS_FUZZ_png_chunk_report ------------------ 545| 0| PNG_CHUNK_WRITE_ERROR); ------------------ | | 2054| 0|#define PNG_CHUNK_WRITE_ERROR 1 /* an error only on write */ ------------------ 546| 0| return; 547| 0| } 548| | 549| 4| memcpy(info_ptr->pcal_purpose, purpose, length); 550| | 551| 4| info_ptr->free_me |= PNG_FREE_PCAL; ------------------ | | 1842| 4|#define PNG_FREE_PCAL 0x0080U ------------------ 552| | 553| 4| png_debug(3, "storing X0, X1, type, and nparams in info"); ------------------ | | 145| 4|# define png_debug(l, m) ((void)0) ------------------ 554| 4| info_ptr->pcal_X0 = X0; 555| 4| info_ptr->pcal_X1 = X1; 556| 4| info_ptr->pcal_type = (png_byte)type; 557| 4| info_ptr->pcal_nparams = (png_byte)nparams; 558| | 559| 4| length = strlen(units) + 1; 560| 4| png_debug1(3, "allocating units for info (%lu bytes)", ------------------ | | 148| 4|# define png_debug1(l, m, p1) ((void)0) ------------------ 561| 4| (unsigned long)length); 562| | 563| 4| info_ptr->pcal_units = png_voidcast(png_charp, ------------------ | | 535| 4|# define png_voidcast(type, value) (value) ------------------ 564| 4| png_malloc_warn(png_ptr, length)); 565| | 566| 4| if (info_ptr->pcal_units == NULL) ------------------ | Branch (566:8): [True: 0, False: 4] ------------------ 567| 0| { 568| 0| png_warning(png_ptr, "Insufficient memory for pCAL units"); ------------------ | | 450| 0|#define png_warning OSS_FUZZ_png_warning ------------------ 569| 0| return; 570| 0| } 571| | 572| 4| memcpy(info_ptr->pcal_units, units, length); 573| | 574| 4| info_ptr->pcal_params = png_voidcast(png_charpp, png_malloc_warn(png_ptr, ------------------ | | 535| 4|# define png_voidcast(type, value) (value) ------------------ 575| 4| (size_t)(((unsigned int)nparams + 1) * (sizeof (png_charp))))); 576| | 577| 4| if (info_ptr->pcal_params == NULL) ------------------ | Branch (577:8): [True: 0, False: 4] ------------------ 578| 0| { 579| 0| png_warning(png_ptr, "Insufficient memory for pCAL params"); ------------------ | | 450| 0|#define png_warning OSS_FUZZ_png_warning ------------------ 580| 0| return; 581| 0| } 582| | 583| 4| memset(info_ptr->pcal_params, 0, ((unsigned int)nparams + 1) * 584| 4| (sizeof (png_charp))); 585| | 586| 12| for (i = 0; i < nparams; i++) ------------------ | Branch (586:16): [True: 8, False: 4] ------------------ 587| 8| { 588| 8| length = strlen(params[i]) + 1; 589| 8| png_debug2(3, "allocating parameter %d for info (%lu bytes)", i, ------------------ | | 151| 8|# define png_debug2(l, m, p1, p2) ((void)0) ------------------ 590| 8| (unsigned long)length); 591| | 592| 8| info_ptr->pcal_params[i] = (png_charp)png_malloc_warn(png_ptr, length); ------------------ | | 349| 8|#define png_malloc_warn OSS_FUZZ_png_malloc_warn ------------------ 593| | 594| 8| if (info_ptr->pcal_params[i] == NULL) ------------------ | Branch (594:11): [True: 0, False: 8] ------------------ 595| 0| { 596| 0| png_warning(png_ptr, "Insufficient memory for pCAL parameter"); ------------------ | | 450| 0|#define png_warning OSS_FUZZ_png_warning ------------------ 597| 0| return; 598| 0| } 599| | 600| 8| memcpy(info_ptr->pcal_params[i], params[i], length); 601| 8| } 602| | 603| 4| info_ptr->valid |= PNG_INFO_pCAL; ------------------ | | 740| 4|#define PNG_INFO_pCAL 0x0400U ------------------ 604| 4|} OSS_FUZZ_png_set_sCAL_s: 611| 6|{ 612| 6| size_t lengthw = 0, lengthh = 0; 613| | 614| 6| png_debug1(1, "in %s storage function", "sCAL"); ------------------ | | 148| 6|# define png_debug1(l, m, p1) ((void)0) ------------------ 615| | 616| 6| if (png_ptr == NULL || info_ptr == NULL) ------------------ | Branch (616:8): [True: 0, False: 6] | Branch (616:27): [True: 0, False: 6] ------------------ 617| 0| return; 618| | 619| | /* Double check the unit (should never get here with an invalid 620| | * unit unless this is an API call.) 621| | */ 622| 6| if (unit != 1 && unit != 2) ------------------ | Branch (622:8): [True: 0, False: 6] | Branch (622:21): [True: 0, False: 0] ------------------ 623| 0| png_error(png_ptr, "Invalid sCAL unit"); ------------------ | | 252| 0|#define png_error OSS_FUZZ_png_error ------------------ 624| | 625| 6| if (swidth == NULL || (lengthw = strlen(swidth)) == 0 || ------------------ | Branch (625:8): [True: 0, False: 6] | Branch (625:26): [True: 0, False: 6] ------------------ 626| 6| swidth[0] == 45 /* '-' */ || !png_check_fp_string(swidth, lengthw)) ------------------ | | 87| 6|#define png_check_fp_string OSS_FUZZ_png_check_fp_string ------------------ | Branch (626:8): [True: 0, False: 6] | Branch (626:37): [True: 0, False: 6] ------------------ 627| 0| png_error(png_ptr, "Invalid sCAL width"); ------------------ | | 252| 0|#define png_error OSS_FUZZ_png_error ------------------ 628| | 629| 6| if (sheight == NULL || (lengthh = strlen(sheight)) == 0 || ------------------ | Branch (629:8): [True: 0, False: 6] | Branch (629:27): [True: 0, False: 6] ------------------ 630| 6| sheight[0] == 45 /* '-' */ || !png_check_fp_string(sheight, lengthh)) ------------------ | | 87| 6|#define png_check_fp_string OSS_FUZZ_png_check_fp_string ------------------ | Branch (630:8): [True: 0, False: 6] | Branch (630:38): [True: 0, False: 6] ------------------ 631| 0| png_error(png_ptr, "Invalid sCAL height"); ------------------ | | 252| 0|#define png_error OSS_FUZZ_png_error ------------------ 632| | 633| 6| info_ptr->scal_unit = (png_byte)unit; 634| | 635| 6| ++lengthw; 636| | 637| 6| png_debug1(3, "allocating unit for info (%u bytes)", (unsigned int)lengthw); ------------------ | | 148| 6|# define png_debug1(l, m, p1) ((void)0) ------------------ 638| | 639| 6| info_ptr->scal_s_width = png_voidcast(png_charp, ------------------ | | 535| 6|# define png_voidcast(type, value) (value) ------------------ 640| 6| png_malloc_warn(png_ptr, lengthw)); 641| | 642| 6| if (info_ptr->scal_s_width == NULL) ------------------ | Branch (642:8): [True: 0, False: 6] ------------------ 643| 0| { 644| 0| png_warning(png_ptr, "Memory allocation failed while processing sCAL"); ------------------ | | 450| 0|#define png_warning OSS_FUZZ_png_warning ------------------ 645| | 646| 0| return; 647| 0| } 648| | 649| 6| memcpy(info_ptr->scal_s_width, swidth, lengthw); 650| | 651| 6| ++lengthh; 652| | 653| 6| png_debug1(3, "allocating unit for info (%u bytes)", (unsigned int)lengthh); ------------------ | | 148| 6|# define png_debug1(l, m, p1) ((void)0) ------------------ 654| | 655| 6| info_ptr->scal_s_height = png_voidcast(png_charp, ------------------ | | 535| 6|# define png_voidcast(type, value) (value) ------------------ 656| 6| png_malloc_warn(png_ptr, lengthh)); 657| | 658| 6| if (info_ptr->scal_s_height == NULL) ------------------ | Branch (658:8): [True: 0, False: 6] ------------------ 659| 0| { 660| 0| png_free(png_ptr, info_ptr->scal_s_width); ------------------ | | 253| 0|#define png_free OSS_FUZZ_png_free ------------------ 661| 0| info_ptr->scal_s_width = NULL; 662| | 663| 0| png_warning(png_ptr, "Memory allocation failed while processing sCAL"); ------------------ | | 450| 0|#define png_warning OSS_FUZZ_png_warning ------------------ 664| 0| return; 665| 0| } 666| | 667| 6| memcpy(info_ptr->scal_s_height, sheight, lengthh); 668| | 669| 6| info_ptr->free_me |= PNG_FREE_SCAL; ------------------ | | 1843| 6|#define PNG_FREE_SCAL 0x0100U ------------------ 670| 6| info_ptr->valid |= PNG_INFO_sCAL; ------------------ | | 744| 6|#define PNG_INFO_sCAL 0x4000U /* ESR, 1.0.6 */ ------------------ 671| 6|} OSS_FUZZ_png_set_pHYs: 736| 4|{ 737| 4| png_debug1(1, "in %s storage function", "pHYs"); ------------------ | | 148| 4|# define png_debug1(l, m, p1) ((void)0) ------------------ 738| | 739| 4| if (png_ptr == NULL || info_ptr == NULL) ------------------ | Branch (739:8): [True: 0, False: 4] | Branch (739:27): [True: 0, False: 4] ------------------ 740| 0| return; 741| | 742| 4| info_ptr->x_pixels_per_unit = res_x; 743| 4| info_ptr->y_pixels_per_unit = res_y; 744| 4| info_ptr->phys_unit_type = (png_byte)unit_type; 745| 4| info_ptr->valid |= PNG_INFO_pHYs; ------------------ | | 737| 4|#define PNG_INFO_pHYs 0x0080U ------------------ 746| 4|} OSS_FUZZ_png_set_PLTE: 752| 189|{ 753| 189| png_color safe_palette[PNG_MAX_PALETTE_LENGTH]; 754| 189| png_uint_32 max_palette_length; 755| | 756| 189| png_debug1(1, "in %s storage function", "PLTE"); ------------------ | | 148| 189|# define png_debug1(l, m, p1) ((void)0) ------------------ 757| | 758| 189| if (png_ptr == NULL || info_ptr == NULL) ------------------ | Branch (758:8): [True: 0, False: 189] | Branch (758:27): [True: 0, False: 189] ------------------ 759| 0| return; 760| | 761| 189| max_palette_length = (info_ptr->color_type == PNG_COLOR_TYPE_PALETTE) ? ------------------ | | 667| 189|#define PNG_COLOR_TYPE_PALETTE (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_PALETTE) | | ------------------ | | | | 662| 189|#define PNG_COLOR_MASK_COLOR 2 | | ------------------ | | #define PNG_COLOR_TYPE_PALETTE (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_PALETTE) | | ------------------ | | | | 661| 189|#define PNG_COLOR_MASK_PALETTE 1 | | ------------------ ------------------ | Branch (761:25): [True: 150, False: 39] ------------------ 762| 150| (1 << info_ptr->bit_depth) : PNG_MAX_PALETTE_LENGTH; ------------------ | | 723| 228|#define PNG_MAX_PALETTE_LENGTH 256 ------------------ 763| | 764| 189| if (num_palette < 0 || num_palette > (int) max_palette_length) ------------------ | Branch (764:8): [True: 0, False: 189] | Branch (764:27): [True: 0, False: 189] ------------------ 765| 0| { 766| 0| if (info_ptr->color_type == PNG_COLOR_TYPE_PALETTE) ------------------ | | 667| 0|#define PNG_COLOR_TYPE_PALETTE (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_PALETTE) | | ------------------ | | | | 662| 0|#define PNG_COLOR_MASK_COLOR 2 | | ------------------ | | #define PNG_COLOR_TYPE_PALETTE (PNG_COLOR_MASK_COLOR | PNG_COLOR_MASK_PALETTE) | | ------------------ | | | | 661| 0|#define PNG_COLOR_MASK_PALETTE 1 | | ------------------ ------------------ | Branch (766:11): [True: 0, False: 0] ------------------ 767| 0| png_error(png_ptr, "Invalid palette length"); ------------------ | | 252| 0|#define png_error OSS_FUZZ_png_error ------------------ 768| | 769| 0| else 770| 0| { 771| 0| png_warning(png_ptr, "Invalid palette length"); ------------------ | | 450| 0|#define png_warning OSS_FUZZ_png_warning ------------------ 772| | 773| 0| return; 774| 0| } 775| 0| } 776| | 777| 189| if ((num_palette > 0 && palette == NULL) || ------------------ | Branch (777:9): [True: 187, False: 2] | Branch (777:28): [True: 0, False: 187] ------------------ 778| 189| (num_palette == 0 ------------------ | Branch (778:8): [True: 2, False: 187] ------------------ 779| 2|# ifdef PNG_MNG_FEATURES_SUPPORTED 780| 2| && (png_ptr->mng_features_permitted & PNG_FLAG_MNG_EMPTY_PLTE) == 0 ------------------ | | 875| 2|#define PNG_FLAG_MNG_EMPTY_PLTE 0x01 ------------------ | Branch (780:16): [True: 2, False: 0] ------------------ 781| 189|# endif 782| 189| )) 783| 2| { 784| 2| png_error(png_ptr, "Invalid palette"); ------------------ | | 252| 4|#define png_error OSS_FUZZ_png_error ------------------ 785| 2| } 786| | 787| | /* Snapshot the caller's palette before freeing, in case it points to 788| | * info_ptr->palette (getter-to-setter aliasing). 789| | */ 790| 187| if (num_palette > 0) ------------------ | Branch (790:8): [True: 187, False: 0] ------------------ 791| 187| memcpy(safe_palette, palette, (unsigned int)num_palette * 792| 187| (sizeof (png_color))); 793| | 794| 187| palette = safe_palette; 795| | 796| 187| png_free_data(png_ptr, info_ptr, PNG_FREE_PLTE, 0); ------------------ | | 254| 187|#define png_free_data OSS_FUZZ_png_free_data ------------------ png_free_data(png_ptr, info_ptr, PNG_FREE_PLTE, 0); ------------------ | | 1848| 187|#define PNG_FREE_PLTE 0x1000U ------------------ 797| | 798| | /* Changed in libpng-1.2.1 to allocate PNG_MAX_PALETTE_LENGTH instead 799| | * of num_palette entries, in case of an invalid PNG file or incorrect 800| | * call to png_set_PLTE() with too-large sample values. 801| | * 802| | * Allocate independent buffers for info_ptr and png_ptr so that the 803| | * lifetime of png_ptr->palette is decoupled from the lifetime of 804| | * info_ptr->palette. Previously, these two pointers were aliased, 805| | * which caused a use-after-free vulnerability if png_free_data freed 806| | * info_ptr->palette while png_ptr->palette was still in use by the 807| | * row transform functions (e.g. png_do_expand_palette). 808| | * 809| | * Both buffers are allocated with png_calloc to zero-fill, because 810| | * the ARM NEON palette riffle reads all 256 entries unconditionally, 811| | * regardless of num_palette. 812| | */ 813| 187| png_free(png_ptr, png_ptr->palette); ------------------ | | 253| 187|#define png_free OSS_FUZZ_png_free ------------------ 814| 187| png_ptr->palette = png_voidcast(png_colorp, png_calloc(png_ptr, ------------------ | | 535| 187|# define png_voidcast(type, value) (value) ------------------ 815| 187| PNG_MAX_PALETTE_LENGTH * (sizeof (png_color)))); 816| 187| info_ptr->palette = png_voidcast(png_colorp, png_calloc(png_ptr, ------------------ | | 535| 187|# define png_voidcast(type, value) (value) ------------------ 817| 187| PNG_MAX_PALETTE_LENGTH * (sizeof (png_color)))); 818| 187| png_ptr->num_palette = info_ptr->num_palette = (png_uint_16)num_palette; 819| | 820| 187| if (num_palette > 0) ------------------ | Branch (820:8): [True: 187, False: 0] ------------------ 821| 187| { 822| 187| memcpy(info_ptr->palette, palette, (unsigned int)num_palette * 823| 187| (sizeof (png_color))); 824| 187| memcpy(png_ptr->palette, palette, (unsigned int)num_palette * 825| 187| (sizeof (png_color))); 826| 187| } 827| | 828| 187| info_ptr->free_me |= PNG_FREE_PLTE; ------------------ | | 1848| 187|#define PNG_FREE_PLTE 0x1000U ------------------ 829| 187| info_ptr->valid |= PNG_INFO_PLTE; ------------------ | | 733| 187|#define PNG_INFO_PLTE 0x0008U ------------------ 830| 187|} OSS_FUZZ_png_set_sBIT: 836| 8|{ 837| 8| png_debug1(1, "in %s storage function", "sBIT"); ------------------ | | 148| 8|# define png_debug1(l, m, p1) ((void)0) ------------------ 838| | 839| 8| if (png_ptr == NULL || info_ptr == NULL || sig_bit == NULL) ------------------ | Branch (839:8): [True: 0, False: 8] | Branch (839:27): [True: 0, False: 8] | Branch (839:47): [True: 0, False: 8] ------------------ 840| 0| return; 841| | 842| 8| info_ptr->sig_bit = *sig_bit; 843| 8| info_ptr->valid |= PNG_INFO_sBIT; ------------------ | | 731| 8|#define PNG_INFO_sBIT 0x0002U ------------------ 844| 8|} OSS_FUZZ_png_set_sRGB: 850| 424|{ 851| 424| png_debug1(1, "in %s storage function", "sRGB"); ------------------ | | 148| 424|# define png_debug1(l, m, p1) ((void)0) ------------------ 852| | 853| 424| if (png_ptr == NULL || info_ptr == NULL) ------------------ | Branch (853:8): [True: 0, False: 424] | Branch (853:27): [True: 0, False: 424] ------------------ 854| 0| return; 855| | 856| 424| info_ptr->rendering_intent = srgb_intent; 857| 424| info_ptr->valid |= PNG_INFO_sRGB; ------------------ | | 741| 424|#define PNG_INFO_sRGB 0x0800U /* GR-P, 0.96a */ ------------------ 858| 424|} OSS_FUZZ_png_set_text_2: 955| 12.6k|{ 956| 12.6k| int i; 957| 12.6k| png_textp old_text = NULL; 958| | 959| 12.6k| png_debug1(1, "in text storage function, chunk typeid = 0x%lx", ------------------ | | 148| 12.6k|# define png_debug1(l, m, p1) ((void)0) ------------------ 960| 12.6k| png_ptr == NULL ? 0xabadca11UL : (unsigned long)png_ptr->chunk_name); 961| | 962| 12.6k| if (png_ptr == NULL || info_ptr == NULL || num_text <= 0 || text_ptr == NULL) ------------------ | Branch (962:8): [True: 0, False: 12.6k] | Branch (962:27): [True: 0, False: 12.6k] | Branch (962:47): [True: 0, False: 12.6k] | Branch (962:64): [True: 0, False: 12.6k] ------------------ 963| 0| return 0; 964| | 965| | /* Make sure we have enough space in the "text" array in info_struct 966| | * to hold all of the incoming text_ptr objects. This compare can't overflow 967| | * because max_text >= num_text (anyway, subtract of two positive integers 968| | * can't overflow in any case.) 969| | */ 970| 12.6k| if (num_text > info_ptr->max_text - info_ptr->num_text) ------------------ | Branch (970:8): [True: 1.68k, False: 10.9k] ------------------ 971| 1.68k| { 972| 1.68k| int old_num_text = info_ptr->num_text; 973| 1.68k| int max_text; 974| 1.68k| png_textp new_text = NULL; 975| | 976| | /* Calculate an appropriate max_text, checking for overflow. */ 977| 1.68k| max_text = old_num_text; 978| 1.68k| if (num_text <= INT_MAX - max_text) ------------------ | Branch (978:11): [True: 1.68k, False: 0] ------------------ 979| 1.68k| { 980| 1.68k| max_text += num_text; 981| | 982| | /* Round up to a multiple of 8 */ 983| 1.68k| if (max_text < INT_MAX-8) ------------------ | Branch (983:14): [True: 1.68k, False: 0] ------------------ 984| 1.68k| max_text = (max_text + 8) & ~0x7; 985| | 986| 0| else 987| 0| max_text = INT_MAX; 988| | 989| | /* Now allocate a new array and copy the old members in; this does all 990| | * the overflow checks. 991| | */ 992| 1.68k| new_text = png_voidcast(png_textp,png_realloc_array(png_ptr, ------------------ | | 535| 1.68k|# define png_voidcast(type, value) (value) ------------------ 993| 1.68k| info_ptr->text, old_num_text, max_text-old_num_text, 994| 1.68k| sizeof *new_text)); 995| 1.68k| } 996| | 997| 1.68k| if (new_text == NULL) ------------------ | Branch (997:11): [True: 0, False: 1.68k] ------------------ 998| 0| { 999| 0| png_chunk_report(png_ptr, "too many text chunks", ------------------ | | 83| 0|#define png_chunk_report OSS_FUZZ_png_chunk_report ------------------ 1000| 0| PNG_CHUNK_WRITE_ERROR); ------------------ | | 2054| 0|#define PNG_CHUNK_WRITE_ERROR 1 /* an error only on write */ ------------------ 1001| | 1002| 0| return 1; 1003| 0| } 1004| | 1005| | /* Defer freeing the old array until after the copy loop below, 1006| | * in case text_ptr aliases info_ptr->text (getter-to-setter). 1007| | */ 1008| 1.68k| old_text = info_ptr->text; 1009| | 1010| 1.68k| info_ptr->text = new_text; 1011| 1.68k| info_ptr->free_me |= PNG_FREE_TEXT; ------------------ | | 1850| 1.68k|#define PNG_FREE_TEXT 0x4000U ------------------ 1012| 1.68k| info_ptr->max_text = max_text; 1013| | /* num_text is adjusted below as the entries are copied in */ 1014| | 1015| 1.68k| png_debug1(3, "allocated %d entries for info_ptr->text", max_text); ------------------ | | 148| 1.68k|# define png_debug1(l, m, p1) ((void)0) ------------------ 1016| 1.68k| } 1017| | 1018| 25.2k| for (i = 0; i < num_text; i++) ------------------ | Branch (1018:16): [True: 12.6k, False: 12.6k] ------------------ 1019| 12.6k| { 1020| 12.6k| size_t text_length, key_len; 1021| 12.6k| size_t lang_len, lang_key_len; 1022| 12.6k| png_textp textp = &(info_ptr->text[info_ptr->num_text]); 1023| | 1024| 12.6k| if (text_ptr[i].key == NULL) ------------------ | Branch (1024:11): [True: 0, False: 12.6k] ------------------ 1025| 0| continue; 1026| | 1027| 12.6k| if (text_ptr[i].compression < PNG_TEXT_COMPRESSION_NONE || ------------------ | | 586| 25.2k|#define PNG_TEXT_COMPRESSION_NONE -1 ------------------ | Branch (1027:11): [True: 0, False: 12.6k] ------------------ 1028| 12.6k| text_ptr[i].compression >= PNG_TEXT_COMPRESSION_LAST) ------------------ | | 590| 12.6k|#define PNG_TEXT_COMPRESSION_LAST 3 /* Not a valid value */ ------------------ | Branch (1028:11): [True: 0, False: 12.6k] ------------------ 1029| 0| { 1030| 0| png_chunk_report(png_ptr, "text compression mode is out of range", ------------------ | | 83| 0|#define png_chunk_report OSS_FUZZ_png_chunk_report ------------------ 1031| 0| PNG_CHUNK_WRITE_ERROR); ------------------ | | 2054| 0|#define PNG_CHUNK_WRITE_ERROR 1 /* an error only on write */ ------------------ 1032| 0| continue; 1033| 0| } 1034| | 1035| 12.6k| key_len = strlen(text_ptr[i].key); 1036| | 1037| 12.6k| if (text_ptr[i].compression <= 0) ------------------ | Branch (1037:11): [True: 12.0k, False: 586] ------------------ 1038| 12.0k| { 1039| 12.0k| lang_len = 0; 1040| 12.0k| lang_key_len = 0; 1041| 12.0k| } 1042| | 1043| 586| else 1044| 586|# ifdef PNG_iTXt_SUPPORTED 1045| 586| { 1046| | /* Set iTXt data */ 1047| | 1048| 586| if (text_ptr[i].lang != NULL) ------------------ | Branch (1048:14): [True: 586, False: 0] ------------------ 1049| 586| lang_len = strlen(text_ptr[i].lang); 1050| | 1051| 0| else 1052| 0| lang_len = 0; 1053| | 1054| 586| if (text_ptr[i].lang_key != NULL) ------------------ | Branch (1054:14): [True: 586, False: 0] ------------------ 1055| 586| lang_key_len = strlen(text_ptr[i].lang_key); 1056| | 1057| 0| else 1058| 0| lang_key_len = 0; 1059| 586| } 1060| |# else /* iTXt */ 1061| | { 1062| | png_chunk_report(png_ptr, "iTXt chunk not supported", 1063| | PNG_CHUNK_WRITE_ERROR); 1064| | continue; 1065| | } 1066| |# endif 1067| | 1068| 12.6k| if (text_ptr[i].text == NULL || text_ptr[i].text[0] == '\0') ------------------ | Branch (1068:11): [True: 0, False: 12.6k] | Branch (1068:39): [True: 11.8k, False: 783] ------------------ 1069| 11.8k| { 1070| 11.8k| text_length = 0; 1071| 11.8k|# ifdef PNG_iTXt_SUPPORTED 1072| 11.8k| if (text_ptr[i].compression > 0) ------------------ | Branch (1072:14): [True: 215, False: 11.6k] ------------------ 1073| 215| textp->compression = PNG_ITXT_COMPRESSION_NONE; ------------------ | | 588| 215|#define PNG_ITXT_COMPRESSION_NONE 1 ------------------ 1074| | 1075| 11.6k| else 1076| 11.6k|# endif 1077| 11.6k| textp->compression = PNG_TEXT_COMPRESSION_NONE; ------------------ | | 586| 11.6k|#define PNG_TEXT_COMPRESSION_NONE -1 ------------------ 1078| 11.8k| } 1079| | 1080| 783| else 1081| 783| { 1082| 783| text_length = strlen(text_ptr[i].text); 1083| 783| textp->compression = text_ptr[i].compression; 1084| 783| } 1085| | 1086| 12.6k| textp->key = png_voidcast(png_charp,png_malloc_base(png_ptr, ------------------ | | 535| 12.6k|# define png_voidcast(type, value) (value) ------------------ 1087| 12.6k| key_len + text_length + lang_len + lang_key_len + 4)); 1088| | 1089| 12.6k| if (textp->key == NULL) ------------------ | Branch (1089:11): [True: 0, False: 12.6k] ------------------ 1090| 0| { 1091| 0| png_chunk_report(png_ptr, "text chunk: out of memory", ------------------ | | 83| 0|#define png_chunk_report OSS_FUZZ_png_chunk_report ------------------ 1092| 0| PNG_CHUNK_WRITE_ERROR); ------------------ | | 2054| 0|#define PNG_CHUNK_WRITE_ERROR 1 /* an error only on write */ ------------------ 1093| 0| png_free(png_ptr, old_text); ------------------ | | 253| 0|#define png_free OSS_FUZZ_png_free ------------------ 1094| | 1095| 0| return 1; 1096| 0| } 1097| | 1098| 12.6k| png_debug2(2, "Allocated %lu bytes at %p in png_set_text", ------------------ | | 151| 12.6k|# define png_debug2(l, m, p1, p2) ((void)0) ------------------ 1099| 12.6k| (unsigned long)(png_uint_32) 1100| 12.6k| (key_len + lang_len + lang_key_len + text_length + 4), 1101| 12.6k| textp->key); 1102| | 1103| 12.6k| memcpy(textp->key, text_ptr[i].key, key_len); 1104| 12.6k| *(textp->key + key_len) = '\0'; 1105| | 1106| 12.6k| if (text_ptr[i].compression > 0) ------------------ | Branch (1106:11): [True: 586, False: 12.0k] ------------------ 1107| 586| { 1108| 586| textp->lang = textp->key + key_len + 1; 1109| 586| memcpy(textp->lang, text_ptr[i].lang, lang_len); 1110| 586| *(textp->lang + lang_len) = '\0'; 1111| 586| textp->lang_key = textp->lang + lang_len + 1; 1112| 586| memcpy(textp->lang_key, text_ptr[i].lang_key, lang_key_len); 1113| 586| *(textp->lang_key + lang_key_len) = '\0'; 1114| 586| textp->text = textp->lang_key + lang_key_len + 1; 1115| 586| } 1116| | 1117| 12.0k| else 1118| 12.0k| { 1119| 12.0k| textp->lang=NULL; 1120| 12.0k| textp->lang_key=NULL; 1121| 12.0k| textp->text = textp->key + key_len + 1; 1122| 12.0k| } 1123| | 1124| 12.6k| if (text_length != 0) ------------------ | Branch (1124:11): [True: 783, False: 11.8k] ------------------ 1125| 783| memcpy(textp->text, text_ptr[i].text, text_length); 1126| | 1127| 12.6k| *(textp->text + text_length) = '\0'; 1128| | 1129| 12.6k|# ifdef PNG_iTXt_SUPPORTED 1130| 12.6k| if (textp->compression > 0) ------------------ | Branch (1130:11): [True: 586, False: 12.0k] ------------------ 1131| 586| { 1132| 586| textp->text_length = 0; 1133| 586| textp->itxt_length = text_length; 1134| 586| } 1135| | 1136| 12.0k| else 1137| 12.0k|# endif 1138| 12.0k| { 1139| 12.0k| textp->text_length = text_length; 1140| 12.0k| textp->itxt_length = 0; 1141| 12.0k| } 1142| | 1143| 12.6k| info_ptr->num_text++; 1144| 12.6k| png_debug1(3, "transferred text chunk %d", info_ptr->num_text); ------------------ | | 148| 12.6k|# define png_debug1(l, m, p1) ((void)0) ------------------ 1145| 12.6k| } 1146| | 1147| 12.6k| png_free(png_ptr, old_text); ------------------ | | 253| 12.6k|#define png_free OSS_FUZZ_png_free ------------------ 1148| | 1149| 12.6k| return 0; 1150| 12.6k|} OSS_FUZZ_png_set_tIME: 1157| 13|{ 1158| 13| png_debug1(1, "in %s storage function", "tIME"); ------------------ | | 148| 13|# define png_debug1(l, m, p1) ((void)0) ------------------ 1159| | 1160| 13| if (png_ptr == NULL || info_ptr == NULL || mod_time == NULL || ------------------ | Branch (1160:8): [True: 0, False: 13] | Branch (1160:27): [True: 0, False: 13] | Branch (1160:47): [True: 0, False: 13] ------------------ 1161| 13| (png_ptr->mode & PNG_WROTE_tIME) != 0) ------------------ | | 649| 13|#define PNG_WROTE_tIME 0x200U ------------------ | Branch (1161:8): [True: 0, False: 13] ------------------ 1162| 0| return; 1163| | 1164| 13| if (mod_time->month == 0 || mod_time->month > 12 || ------------------ | Branch (1164:8): [True: 1, False: 12] | Branch (1164:34): [True: 1, False: 11] ------------------ 1165| 11| mod_time->day == 0 || mod_time->day > 31 || ------------------ | Branch (1165:8): [True: 1, False: 10] | Branch (1165:34): [True: 3, False: 7] ------------------ 1166| 7| mod_time->hour > 23 || mod_time->minute > 59 || ------------------ | Branch (1166:8): [True: 1, False: 6] | Branch (1166:34): [True: 1, False: 5] ------------------ 1167| 5| mod_time->second > 60) ------------------ | Branch (1167:8): [True: 3, False: 2] ------------------ 1168| 11| { 1169| 11| png_warning(png_ptr, "Ignoring invalid time value"); ------------------ | | 450| 11|#define png_warning OSS_FUZZ_png_warning ------------------ 1170| | 1171| 11| return; 1172| 11| } 1173| | 1174| 2| info_ptr->mod_time = *mod_time; 1175| 2| info_ptr->valid |= PNG_INFO_tIME; ------------------ | | 739| 2|#define PNG_INFO_tIME 0x0200U ------------------ 1176| 2|} OSS_FUZZ_png_set_tRNS: 1183| 598|{ 1184| 598| png_debug1(1, "in %s storage function", "tRNS"); ------------------ | | 148| 598|# define png_debug1(l, m, p1) ((void)0) ------------------ 1185| | 1186| 598| if (png_ptr == NULL || info_ptr == NULL) ------------------ | Branch (1186:8): [True: 0, False: 598] | Branch (1186:27): [True: 0, False: 598] ------------------ 1187| | 1188| 0| return; 1189| | 1190| 598| if (trans_alpha != NULL) ------------------ | Branch (1190:8): [True: 598, False: 0] ------------------ 1191| 598| { 1192| | /* Snapshot the caller's trans_alpha before freeing, in case it 1193| | * points to info_ptr->trans_alpha (getter-to-setter aliasing). 1194| | */ 1195| 598| png_byte safe_trans[PNG_MAX_PALETTE_LENGTH]; 1196| | 1197| 598| if (num_trans > 0 && num_trans <= PNG_MAX_PALETTE_LENGTH) ------------------ | | 723| 598|#define PNG_MAX_PALETTE_LENGTH 256 ------------------ | Branch (1197:12): [True: 598, False: 0] | Branch (1197:29): [True: 598, False: 0] ------------------ 1198| 598| memcpy(safe_trans, trans_alpha, (size_t)num_trans); 1199| | 1200| 598| trans_alpha = safe_trans; 1201| | 1202| 598| png_free_data(png_ptr, info_ptr, PNG_FREE_TRNS, 0); ------------------ | | 254| 598|#define png_free_data OSS_FUZZ_png_free_data ------------------ png_free_data(png_ptr, info_ptr, PNG_FREE_TRNS, 0); ------------------ | | 1849| 598|#define PNG_FREE_TRNS 0x2000U ------------------ 1203| | 1204| 598| if (num_trans > 0 && num_trans <= PNG_MAX_PALETTE_LENGTH) ------------------ | | 723| 598|#define PNG_MAX_PALETTE_LENGTH 256 ------------------ | Branch (1204:12): [True: 598, False: 0] | Branch (1204:29): [True: 598, False: 0] ------------------ 1205| 598| { 1206| | /* Allocate info_ptr's copy of the transparency data. 1207| | * Initialize all entries to fully opaque (0xff), then overwrite 1208| | * the first num_trans entries with the actual values. 1209| | */ 1210| 598| info_ptr->trans_alpha = png_voidcast(png_bytep, ------------------ | | 535| 598|# define png_voidcast(type, value) (value) ------------------ 1211| 598| png_malloc(png_ptr, PNG_MAX_PALETTE_LENGTH)); 1212| 598| memset(info_ptr->trans_alpha, 0xff, PNG_MAX_PALETTE_LENGTH); ------------------ | | 723| 598|#define PNG_MAX_PALETTE_LENGTH 256 ------------------ 1213| 598| memcpy(info_ptr->trans_alpha, trans_alpha, (size_t)num_trans); 1214| 598| info_ptr->free_me |= PNG_FREE_TRNS; ------------------ | | 1849| 598|#define PNG_FREE_TRNS 0x2000U ------------------ 1215| 598| info_ptr->valid |= PNG_INFO_tRNS; ------------------ | | 734| 598|#define PNG_INFO_tRNS 0x0010U ------------------ 1216| | 1217| | /* Allocate an independent copy for png_struct, so that the 1218| | * lifetime of png_ptr->trans_alpha is decoupled from the 1219| | * lifetime of info_ptr->trans_alpha. Previously these two 1220| | * pointers were aliased, which caused a use-after-free if 1221| | * png_free_data freed info_ptr->trans_alpha while 1222| | * png_ptr->trans_alpha was still in use by the row transform 1223| | * functions (e.g. png_do_expand_palette). 1224| | */ 1225| 598| png_free(png_ptr, png_ptr->trans_alpha); ------------------ | | 253| 598|#define png_free OSS_FUZZ_png_free ------------------ 1226| 598| png_ptr->trans_alpha = png_voidcast(png_bytep, ------------------ | | 535| 598|# define png_voidcast(type, value) (value) ------------------ 1227| 598| png_malloc(png_ptr, PNG_MAX_PALETTE_LENGTH)); 1228| 598| memset(png_ptr->trans_alpha, 0xff, PNG_MAX_PALETTE_LENGTH); ------------------ | | 723| 598|#define PNG_MAX_PALETTE_LENGTH 256 ------------------ 1229| 598| memcpy(png_ptr->trans_alpha, trans_alpha, (size_t)num_trans); 1230| 598| } 1231| 0| else 1232| 0| { 1233| 0| png_free(png_ptr, png_ptr->trans_alpha); ------------------ | | 253| 0|#define png_free OSS_FUZZ_png_free ------------------ 1234| 0| png_ptr->trans_alpha = NULL; 1235| 0| } 1236| 598| } 1237| | 1238| 598| if (trans_color != NULL) ------------------ | Branch (1238:8): [True: 598, False: 0] ------------------ 1239| 598| { 1240| 598|#ifdef PNG_WARNINGS_SUPPORTED 1241| 598| if (info_ptr->bit_depth < 16) ------------------ | Branch (1241:11): [True: 390, False: 208] ------------------ 1242| 390| { 1243| 390| int sample_max = (1 << info_ptr->bit_depth) - 1; 1244| | 1245| 390| if ((info_ptr->color_type == PNG_COLOR_TYPE_GRAY && ------------------ | | 666| 780|#define PNG_COLOR_TYPE_GRAY 0 ------------------ | Branch (1245:15): [True: 196, False: 194] ------------------ 1246| 196| trans_color->gray > sample_max) || ------------------ | Branch (1246:14): [True: 42, False: 154] ------------------ 1247| 348| (info_ptr->color_type == PNG_COLOR_TYPE_RGB && ------------------ | | 668| 696|#define PNG_COLOR_TYPE_RGB (PNG_COLOR_MASK_COLOR) | | ------------------ | | | | 662| 348|#define PNG_COLOR_MASK_COLOR 2 | | ------------------ ------------------ | Branch (1247:15): [True: 157, False: 191] ------------------ 1248| 157| (trans_color->red > sample_max || ------------------ | Branch (1248:15): [True: 17, False: 140] ------------------ 1249| 140| trans_color->green > sample_max || ------------------ | Branch (1249:14): [True: 23, False: 117] ------------------ 1250| 117| trans_color->blue > sample_max))) ------------------ | Branch (1250:14): [True: 33, False: 84] ------------------ 1251| 115| png_warning(png_ptr, ------------------ | | 450| 115|#define png_warning OSS_FUZZ_png_warning ------------------ 1252| 115| "tRNS chunk has out-of-range samples for bit_depth"); 1253| 390| } 1254| 598|#endif 1255| | 1256| 598| info_ptr->trans_color = *trans_color; 1257| | 1258| 598| if (num_trans == 0) ------------------ | Branch (1258:11): [True: 0, False: 598] ------------------ 1259| 0| num_trans = 1; 1260| 598| } 1261| | 1262| 598| info_ptr->num_trans = (png_uint_16)num_trans; 1263| | 1264| 598| if (num_trans != 0) ------------------ | Branch (1264:8): [True: 598, False: 0] ------------------ 1265| 598| { 1266| 598| info_ptr->free_me |= PNG_FREE_TRNS; ------------------ | | 1849| 598|#define PNG_FREE_TRNS 0x2000U ------------------ 1267| 598| info_ptr->valid |= PNG_INFO_tRNS; ------------------ | | 734| 598|#define PNG_INFO_tRNS 0x0010U ------------------ 1268| 598| } 1269| 598|} OSS_FUZZ_png_set_sPLT: 1284| 1.17k|{ 1285| 1.17k| png_sPLT_tp np; 1286| 1.17k| png_sPLT_tp old_spalettes; 1287| | 1288| 1.17k| png_debug1(1, "in %s storage function", "sPLT"); ------------------ | | 148| 1.17k|# define png_debug1(l, m, p1) ((void)0) ------------------ 1289| | 1290| 1.17k| if (png_ptr == NULL || info_ptr == NULL || nentries <= 0 || entries == NULL) ------------------ | Branch (1290:8): [True: 0, False: 1.17k] | Branch (1290:27): [True: 0, False: 1.17k] | Branch (1290:47): [True: 0, False: 1.17k] | Branch (1290:64): [True: 0, False: 1.17k] ------------------ 1291| 0| return; 1292| | 1293| | /* Use the internal realloc function, which checks for all the possible 1294| | * overflows. Notice that the parameters are (int) and (size_t) 1295| | */ 1296| 1.17k| np = png_voidcast(png_sPLT_tp,png_realloc_array(png_ptr, ------------------ | | 535| 1.17k|# define png_voidcast(type, value) (value) ------------------ 1297| 1.17k| info_ptr->splt_palettes, info_ptr->splt_palettes_num, nentries, 1298| 1.17k| sizeof *np)); 1299| | 1300| 1.17k| if (np == NULL) ------------------ | Branch (1300:8): [True: 0, False: 1.17k] ------------------ 1301| 0| { 1302| | /* Out of memory or too many chunks */ 1303| 0| png_chunk_report(png_ptr, "too many sPLT chunks", PNG_CHUNK_WRITE_ERROR); ------------------ | | 83| 0|#define png_chunk_report OSS_FUZZ_png_chunk_report ------------------ png_chunk_report(png_ptr, "too many sPLT chunks", PNG_CHUNK_WRITE_ERROR); ------------------ | | 2054| 0|#define PNG_CHUNK_WRITE_ERROR 1 /* an error only on write */ ------------------ 1304| 0| return; 1305| 0| } 1306| | 1307| | /* Defer freeing the old array until after the copy loop below, 1308| | * in case entries aliases info_ptr->splt_palettes (getter-to-setter). 1309| | */ 1310| 1.17k| old_spalettes = info_ptr->splt_palettes; 1311| | 1312| 1.17k| info_ptr->splt_palettes = np; 1313| 1.17k| info_ptr->free_me |= PNG_FREE_SPLT; ------------------ | | 1840| 1.17k|#define PNG_FREE_SPLT 0x0020U ------------------ 1314| | 1315| 1.17k| np += info_ptr->splt_palettes_num; 1316| | 1317| 1.17k| do 1318| 1.17k| { 1319| 1.17k| size_t length; 1320| | 1321| | /* Skip invalid input entries */ 1322| 1.17k| if (entries->name == NULL || entries->entries == NULL) ------------------ | Branch (1322:11): [True: 0, False: 1.17k] | Branch (1322:36): [True: 0, False: 1.17k] ------------------ 1323| 0| { 1324| | /* png_handle_sPLT doesn't do this, so this is an app error */ 1325| 0| png_app_error(png_ptr, "png_set_sPLT: invalid sPLT"); ------------------ | | 82| 0|#define png_app_error OSS_FUZZ_png_app_error ------------------ 1326| | /* Just skip the invalid entry */ 1327| 0| continue; 1328| 0| } 1329| | 1330| 1.17k| np->depth = entries->depth; 1331| | 1332| | /* In the event of out-of-memory just return - there's no point keeping 1333| | * on trying to add sPLT chunks. 1334| | */ 1335| 1.17k| length = strlen(entries->name) + 1; 1336| 1.17k| np->name = png_voidcast(png_charp, png_malloc_base(png_ptr, length)); ------------------ | | 535| 1.17k|# define png_voidcast(type, value) (value) ------------------ 1337| | 1338| 1.17k| if (np->name == NULL) ------------------ | Branch (1338:11): [True: 0, False: 1.17k] ------------------ 1339| 0| break; 1340| | 1341| 1.17k| memcpy(np->name, entries->name, length); 1342| | 1343| | /* IMPORTANT: we have memory now that won't get freed if something else 1344| | * goes wrong; this code must free it. png_malloc_array produces no 1345| | * warnings; use a png_chunk_report (below) if there is an error. 1346| | */ 1347| 1.17k| np->entries = png_voidcast(png_sPLT_entryp, png_malloc_array(png_ptr, ------------------ | | 535| 1.17k|# define png_voidcast(type, value) (value) ------------------ 1348| 1.17k| entries->nentries, sizeof (png_sPLT_entry))); 1349| | 1350| 1.17k| if (np->entries == NULL) ------------------ | Branch (1350:11): [True: 0, False: 1.17k] ------------------ 1351| 0| { 1352| 0| png_free(png_ptr, np->name); ------------------ | | 253| 0|#define png_free OSS_FUZZ_png_free ------------------ 1353| 0| np->name = NULL; 1354| 0| break; 1355| 0| } 1356| | 1357| 1.17k| np->nentries = entries->nentries; 1358| | /* This multiply can't overflow because png_malloc_array has already 1359| | * checked it when doing the allocation. 1360| | */ 1361| 1.17k| memcpy(np->entries, entries->entries, 1362| 1.17k| (unsigned int)entries->nentries * sizeof (png_sPLT_entry)); 1363| | 1364| | /* Note that 'continue' skips the advance of the out pointer and out 1365| | * count, so an invalid entry is not added. 1366| | */ 1367| 1.17k| info_ptr->valid |= PNG_INFO_sPLT; ------------------ | | 743| 1.17k|#define PNG_INFO_sPLT 0x2000U /* ESR, 1.0.6 */ ------------------ 1368| 1.17k| ++(info_ptr->splt_palettes_num); 1369| 1.17k| ++np; 1370| 1.17k| ++entries; 1371| 1.17k| } 1372| 1.17k| while (--nentries); ------------------ | Branch (1372:11): [True: 0, False: 1.17k] ------------------ 1373| | 1374| 1.17k| png_free(png_ptr, old_spalettes); ------------------ | | 253| 1.17k|#define png_free OSS_FUZZ_png_free ------------------ 1375| | 1376| 1.17k| if (nentries > 0) ------------------ | Branch (1376:8): [True: 0, False: 1.17k] ------------------ 1377| 0| png_chunk_report(png_ptr, "sPLT out of memory", PNG_CHUNK_WRITE_ERROR); ------------------ | | 83| 0|#define png_chunk_report OSS_FUZZ_png_chunk_report ------------------ png_chunk_report(png_ptr, "sPLT out of memory", PNG_CHUNK_WRITE_ERROR); ------------------ | | 2054| 0|#define PNG_CHUNK_WRITE_ERROR 1 /* an error only on write */ ------------------ 1378| 1.17k|} pngset.c:png_ITU_fixed_16: 207| 496|{ 208| | /* Return a safe uint16_t value scaled according to the ITU H273 rules for 209| | * 16-bit display chromaticities. Functions like the corresponding 210| | * png_fixed() internal function with regard to errors: it's an error on 211| | * write, a chunk_benign_error on read: See the definition of 212| | * png_chunk_report in pngpriv.h. 213| | */ 214| 496| v /= 2; /* rounds to 0 in C: avoids insignificant arithmetic errors */ 215| 496| if (v > 65535 || v < 0) ------------------ | Branch (215:8): [True: 0, False: 496] | Branch (215:21): [True: 0, False: 496] ------------------ 216| 0| { 217| 0| *error = 1; 218| 0| return 0; 219| 0| } 220| | 221| 496| return (png_uint_16)/*SAFE*/v; 222| 496|} OSS_FUZZ_png_set_packing: 50| 334|{ 51| 334| png_debug(1, "in png_set_packing"); ------------------ | | 145| 334|# define png_debug(l, m) ((void)0) ------------------ 52| | 53| 334| if (png_ptr == NULL) ------------------ | Branch (53:8): [True: 0, False: 334] ------------------ 54| 0| return; 55| | 56| 334| if (png_ptr->bit_depth < 8) ------------------ | Branch (56:8): [True: 334, False: 0] ------------------ 57| 334| { 58| 334| png_ptr->transformations |= PNG_PACK; ------------------ | | 660| 334|#define PNG_PACK 0x0004U ------------------ 59| |# ifdef PNG_WRITE_SUPPORTED 60| | png_ptr->usr_bit_depth = 8; 61| |# endif 62| 334| } 63| 334|} OSS_FUZZ_png_set_swap_alpha: 252| 341|{ 253| 341| png_debug(1, "in png_set_swap_alpha"); ------------------ | | 145| 341|# define png_debug(l, m) ((void)0) ------------------ 254| | 255| 341| if (png_ptr == NULL) ------------------ | Branch (255:8): [True: 0, False: 341] ------------------ 256| 0| return; 257| | 258| 341| png_ptr->transformations |= PNG_SWAP_ALPHA; ------------------ | | 675| 341|#define PNG_SWAP_ALPHA 0x20000U ------------------ 259| 341|} OSS_FUZZ_png_set_invert_alpha: 266| 341|{ 267| 341| png_debug(1, "in png_set_invert_alpha"); ------------------ | | 145| 341|# define png_debug(l, m) ((void)0) ------------------ 268| | 269| 341| if (png_ptr == NULL) ------------------ | Branch (269:8): [True: 0, False: 341] ------------------ 270| 0| return; 271| | 272| 341| png_ptr->transformations |= PNG_INVERT_ALPHA; ------------------ | | 677| 341|#define PNG_INVERT_ALPHA 0x80000U ------------------ 273| 341|} OSS_FUZZ_png_do_check_palette_indexes: 729| 432|{ 730| 432| png_debug(1, "in png_do_check_palette_indexes"); ------------------ | | 145| 432|# define png_debug(l, m) ((void)0) ------------------ 731| | 732| 432| if (png_ptr->num_palette < (1 << row_info->bit_depth) && ------------------ | Branch (732:8): [True: 324, False: 108] ------------------ 733| 324| png_ptr->num_palette > 0) /* num_palette can be 0 in MNG files */ ------------------ | Branch (733:7): [True: 324, False: 0] ------------------ 734| 324| { 735| | /* Calculations moved outside switch in an attempt to stop different 736| | * compiler warnings. 'padding' is in *bits* within the last byte, it is 737| | * an 'int' because pixel_depth becomes an 'int' in the expression below, 738| | * and this calculation is used because it avoids warnings that other 739| | * forms produced on either GCC or MSVC. 740| | */ 741| 324| int padding = PNG_PADBITS(row_info->pixel_depth, row_info->width); ------------------ | | 775| 324| ((8 - PNG_TRAILBITS(pixel_bits, width)) % 8) | | ------------------ | | | | 772| 324| (((pixel_bits) * ((width) % (png_uint_32)8)) % 8) | | ------------------ ------------------ 742| 324| png_bytep rp = png_ptr->row_buf + row_info->rowbytes; 743| | 744| 324| switch (row_info->bit_depth) 745| 324| { 746| 0| case 1: ------------------ | Branch (746:10): [True: 0, False: 324] ------------------ 747| 0| { 748| | /* in this case, all bytes must be 0 so we don't need 749| | * to unpack the pixels except for the rightmost one. 750| | */ 751| 0| for (; rp > png_ptr->row_buf; rp--) ------------------ | Branch (751:20): [True: 0, False: 0] ------------------ 752| 0| { 753| 0| if ((*rp >> padding) != 0) ------------------ | Branch (753:19): [True: 0, False: 0] ------------------ 754| 0| png_ptr->num_palette_max = 1; 755| 0| padding = 0; 756| 0| } 757| | 758| 0| break; 759| 0| } 760| | 761| 0| case 2: ------------------ | Branch (761:10): [True: 0, False: 324] ------------------ 762| 0| { 763| 0| for (; rp > png_ptr->row_buf; rp--) ------------------ | Branch (763:20): [True: 0, False: 0] ------------------ 764| 0| { 765| 0| int i = ((*rp >> padding) & 0x03); 766| | 767| 0| if (i > png_ptr->num_palette_max) ------------------ | Branch (767:19): [True: 0, False: 0] ------------------ 768| 0| png_ptr->num_palette_max = i; 769| | 770| 0| i = (((*rp >> padding) >> 2) & 0x03); 771| | 772| 0| if (i > png_ptr->num_palette_max) ------------------ | Branch (772:19): [True: 0, False: 0] ------------------ 773| 0| png_ptr->num_palette_max = i; 774| | 775| 0| i = (((*rp >> padding) >> 4) & 0x03); 776| | 777| 0| if (i > png_ptr->num_palette_max) ------------------ | Branch (777:19): [True: 0, False: 0] ------------------ 778| 0| png_ptr->num_palette_max = i; 779| | 780| 0| i = (((*rp >> padding) >> 6) & 0x03); 781| | 782| 0| if (i > png_ptr->num_palette_max) ------------------ | Branch (782:19): [True: 0, False: 0] ------------------ 783| 0| png_ptr->num_palette_max = i; 784| | 785| 0| padding = 0; 786| 0| } 787| | 788| 0| break; 789| 0| } 790| | 791| 0| case 4: ------------------ | Branch (791:10): [True: 0, False: 324] ------------------ 792| 0| { 793| 0| for (; rp > png_ptr->row_buf; rp--) ------------------ | Branch (793:20): [True: 0, False: 0] ------------------ 794| 0| { 795| 0| int i = ((*rp >> padding) & 0x0f); 796| | 797| 0| if (i > png_ptr->num_palette_max) ------------------ | Branch (797:19): [True: 0, False: 0] ------------------ 798| 0| png_ptr->num_palette_max = i; 799| | 800| 0| i = (((*rp >> padding) >> 4) & 0x0f); 801| | 802| 0| if (i > png_ptr->num_palette_max) ------------------ | Branch (802:19): [True: 0, False: 0] ------------------ 803| 0| png_ptr->num_palette_max = i; 804| | 805| 0| padding = 0; 806| 0| } 807| | 808| 0| break; 809| 0| } 810| | 811| 324| case 8: ------------------ | Branch (811:10): [True: 324, False: 0] ------------------ 812| 324| { 813| 20.5k| for (; rp > png_ptr->row_buf; rp--) ------------------ | Branch (813:20): [True: 20.2k, False: 324] ------------------ 814| 20.2k| { 815| 20.2k| if (*rp > png_ptr->num_palette_max) ------------------ | Branch (815:20): [True: 296, False: 19.9k] ------------------ 816| 296| png_ptr->num_palette_max = (int) *rp; 817| 20.2k| } 818| | 819| 324| break; 820| 0| } 821| | 822| 0| default: ------------------ | Branch (822:10): [True: 0, False: 324] ------------------ 823| 0| break; 824| 324| } 825| 324| } 826| 432|}